Search for packages
| purl | pkg:deb/debian/chromium-browser@70.0.3538.110-1~deb9u1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1tet-594z-b3ct
Aliases: CVE-2018-20346 |
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. | There are no reported fixed by versions. |
|
VCID-2m18-ueth-bfbx
Aliases: CVE-2018-18336 |
Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-2t6u-4s2z-wudw
Aliases: CVE-2018-18347 |
Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-5h7d-bfpp-p7dq
Aliases: CVE-2018-20068 |
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-5mkd-c4p2-bbdr
Aliases: CVE-2018-18341 |
An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-79mj-2cnn-u3em
Aliases: CVE-2018-18349 |
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. | There are no reported fixed by versions. |
|
VCID-7bpy-eggn-6bhq
Aliases: CVE-2018-18350 |
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-7f8j-7qe5-5bf5
Aliases: CVE-2018-18337 |
Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-89dt-b2w8-uudk
Aliases: CVE-2018-18359 |
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-8wjg-twpp-kqe2
Aliases: CVE-2018-20066 |
Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-9859-av5h-67dr
Aliases: CVE-2018-18356 |
A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash. | There are no reported fixed by versions. |
|
VCID-9anb-j45p-e7fs
Aliases: CVE-2018-18358 |
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file. | There are no reported fixed by versions. |
|
VCID-9bfk-6qtv-xuej
Aliases: CVE-2018-18342 |
Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-ad8v-xc47-dye3
Aliases: CVE-2018-17480 |
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-bhwq-p16s-kkfe
Aliases: CVE-2018-20070 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-cd6h-2n4f-sfbv
Aliases: CVE-2018-18352 |
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-h7yf-6njg-t3bz
Aliases: CVE-2018-18353 |
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-h8nd-6jh8-cydc
Aliases: CVE-2018-20067 |
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-hnc5-k7ev-xbh7
Aliases: CVE-2018-17481 |
Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-hum1-axjp-9bgk
Aliases: CVE-2018-18354 |
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-hv7q-b723-nqar
Aliases: CVE-2018-20065 |
Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-jn9j-d88p-4fd4
Aliases: CVE-2018-18346 |
Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-mcbg-jpmj-m3hr
Aliases: CVE-2018-18345 |
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-mdmz-nt6r-yucz
Aliases: CVE-2018-18343 |
Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-mdtr-2tyt-wyft
Aliases: CVE-2018-18338 |
Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-prv4-j4e5-mqfj
Aliases: CVE-2018-18340 |
Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-q59h-zpt1-c7bd
Aliases: CVE-2018-18348 |
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-vcjj-2a4p-cycx
Aliases: CVE-2018-18355 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-vtyw-9eu6-3ydc
Aliases: CVE-2018-18351 |
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-wa8e-7xwa-tba8
Aliases: CVE-2018-18357 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-xqrh-9yp4-zucn
Aliases: CVE-2018-18339 |
Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-z5rq-qtat-nqfy
Aliases: CVE-2018-18344 |
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension. | There are no reported fixed by versions. |
|
VCID-zjd9-mas9-4qa5
Aliases: CVE-2018-18335 |
A buffer overflow vulnerability in the Skia library can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. *Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.* | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-15jp-13mu-rkdj | security update |
CVE-2017-15410
|
| VCID-1cnq-45w5-jqbm | A service worker can send the "activate" event on itself periodically which allows it to run perpetually. This would allow any malicious activity, such as logging an IP address by the service worker, to occur in the background. |
CVE-2018-5179
|
| VCID-1ctt-s3cw-qkb2 | security update |
CVE-2018-6046
|
| VCID-1err-b9xu-bffb | An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6111
|
| VCID-1j7y-gq69-4ybp | security update |
CVE-2017-15394
|
| VCID-1p9m-xmqn-kkem | Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6062
|
| VCID-1qje-s9xs-ekf4 | A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-6087
|
| VCID-1s3a-bb2s-xbhd | Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
CVE-2018-16086
|
| VCID-1sr5-ytxv-27dg | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6104
|
| VCID-1t4m-xz2y-j3cv | Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6079
|
| VCID-25qp-pnca-pyhz | security update |
CVE-2018-6049
|
| VCID-2bzj-1pne-83df | security update |
CVE-2017-5112
|
| VCID-2cy7-4k5v-5kdh | Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6065
|
| VCID-2dvf-u33m-f3f2 | security update |
CVE-2017-5111
|
| VCID-2jxw-zcmk-dubu | security update |
CVE-2017-15408
|
| VCID-2mzs-2qta-1ugx | security update |
CVE-2018-6055
|
| VCID-2n4k-4knu-bqdj | Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. |
CVE-2018-17462
|
| VCID-2p41-qmq6-77fj | security update |
CVE-2017-15393
|
| VCID-2qbg-ms7n-t3ca | Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-17479
|
| VCID-2qct-ke2t-h7gh | The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page. |
CVE-2018-16084
|
| VCID-2qrb-4hnf-ekf5 | Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
CVE-2018-6124
|
| VCID-2s4d-3hm5-6qa9 | An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-17461
|
| VCID-2sjp-scq9-8fcg | Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6064
|
| VCID-2ugy-4wxz-ybc7 | security update |
CVE-2017-15390
|
| VCID-2vfg-4jns-rydh | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6175
|
| VCID-2vrs-fsx1-sucy | Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-16069
|
| VCID-2wy8-j7nm-wfc5 | security update |
CVE-2017-15426
|
| VCID-3cva-5z7z-xbag | security update |
CVE-2018-6033
|
| VCID-3ge9-8gdv-ffcd | A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
CVE-2018-6089
|
| VCID-3gv8-x494-8bgc | A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6073
|
| VCID-3jm1-1p6h-puht | Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. |
CVE-2018-6140
|
| VCID-3sd3-t64s-bqc2 | security update |
CVE-2017-15416
|
| VCID-3sdy-uf9z-q7dt | A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
CVE-2018-6096
|
| VCID-3xs8-jccn-sker | security update |
CVE-2018-6043
|
| VCID-41jr-fnkg-pydt | security update |
CVE-2017-5101
|
| VCID-44xj-fq8m-gufp | Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-16076
|
| VCID-45xp-bhkn-e7ft | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6172
|
| VCID-4bfj-yw9u-dbfv | An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-6090
|
| VCID-4yuz-wbmy-rqh1 | A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
CVE-2018-16071
|
| VCID-583t-kjva-f7cr | security update |
CVE-2018-6052
|
| VCID-5fgs-wt33-eyf6 | Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6136
|
| VCID-5jw7-hptk-zueg | security update |
CVE-2017-5125
|
| VCID-5mfq-37jx-z3gk | security update |
CVE-2017-15395
|
| VCID-5vgh-nww9-7uhk | security update |
CVE-2017-5133
|
| VCID-5vna-88ab-53fp | Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
CVE-2018-6130
|
| VCID-5vy8-u256-x7aa | security update |
CVE-2017-15418
|
| VCID-5wdt-bjtf-j7c4 | security update |
CVE-2018-6035
|
| VCID-62ce-hpjg-33hp | A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6086
|
| VCID-64q6-pxyg-mkay | A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-16080
|
| VCID-6bjh-5yq5-nfgn | Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page. |
CVE-2018-6095
|
| VCID-6cj3-5ten-rfbr | Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2018-16068
|
| VCID-6gtu-v8r3-cuf8 | Incorrect derivation of a packet length in WebRTC caused heap corruption via a crafted video file. This resulted in a potentially exploitable crash. |
CVE-2018-6156
|
| VCID-6me3-vj15-vkc8 | security update |
CVE-2017-7000
|
| VCID-6w5b-4328-fke8 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6163
|
| VCID-6zdk-89nb-1ffe | security update |
CVE-2017-5098
|
| VCID-7k1a-3rg9-h3b3 | Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
CVE-2018-17471
|
| VCID-7pup-vddx-2ke4 | security update |
CVE-2018-6048
|
| VCID-7wcb-6byh-4qaf | security update |
CVE-2017-5132
|
| VCID-8121-a4t8-bycw | Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-17459
|
| VCID-83xy-t5me-ybgj | Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page. |
CVE-2018-6076
|
| VCID-8422-j4v4-nyae | security update |
CVE-2017-15417
|
| VCID-84vd-1ca4-97cm | Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2018-6113
|
| VCID-8frh-ktc6-j7cb | Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page. |
CVE-2018-20071
|
| VCID-8ks7-jg52-qfd5 | security update |
CVE-2018-6047
|
| VCID-8p6x-u2b3-53b1 | Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
CVE-2018-6102
|
| VCID-8snc-rzpq-zube | security update |
CVE-2017-5087
|
| VCID-8u7y-6h25-cyef | Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page. |
CVE-2018-6083
|
| VCID-8uxh-29xn-dkby | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6173
|
| VCID-8v8a-nkjg-c7cn | Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. |
CVE-2018-6132
|
| VCID-916d-s5dw-f3ej | Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted HTML page. |
CVE-2018-17472
|
| VCID-9658-h2hu-pyfs | security update |
CVE-2017-5119
|
| VCID-9bnu-xy22-jka8 | Incorrect array position calculations in V8 in Google Chrome prior to 70.0.3538.102 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
CVE-2018-17478
|
| VCID-9dbh-vb59-vfhb | A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6123
|
| VCID-9f7p-y8sr-q7d4 | Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6069
|
| VCID-9hac-ppef-uke8 | Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
CVE-2018-16087
|
| VCID-9j8q-uusr-n3bs | security update |
CVE-2017-5121
|
| VCID-9r67-rw19-pkda | security update |
CVE-2017-15415
|
| VCID-9vv9-95mg-p3hy | security update |
CVE-2018-6042
|
| VCID-a5dj-gr3k-wbff | security update |
CVE-2017-15392
|
| VCID-a5e9-2w7k-dbbp | Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page. |
CVE-2018-17477
|
| VCID-a668-6xcg-87aj | Insufficient policy enforcement in Extensions API in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
CVE-2018-6138
|
| VCID-a89w-vw5y-5kbp | Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
CVE-2018-6168
|
| VCID-a96y-j7a9-1ugp | Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6067
|
| VCID-ansp-3n1h-h3bk | security update |
CVE-2017-5097
|
| VCID-aqbp-cuvp-zkf2 | Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. |
CVE-2018-6139
|
| VCID-aqds-4gea-kkde | security update |
CVE-2017-15391
|
| VCID-atft-p3jp-qyb4 | A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6061
|
| VCID-avaa-wuk5-2ub1 | An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-17458
|
| VCID-ax2w-7j4x-xqh7 | security update |
CVE-2017-5106
|
| VCID-b78z-k8bn-abfs | Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page. |
CVE-2018-6082
|
| VCID-bacr-j553-s3bf | security update |
CVE-2017-5093
|
| VCID-bhp4-3tc7-vbb1 | security update |
CVE-2017-5089
|
| VCID-bsf6-2t9c-23hh | Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page. |
CVE-2018-6169
|
| VCID-c3hj-yrgy-9kd7 | Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page. |
CVE-2018-6121
|
| VCID-c4cz-sn45-vyhe | security update |
CVE-2017-15386
|
| VCID-c5ej-tb15-nugb | Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6091
|
| VCID-c6j5-gdub-s3fs | security update |
CVE-2017-15429
|
| VCID-c8fe-cn5e-ckac | Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension. |
CVE-2018-16081
|
| VCID-c9jx-awwn-abfv | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6166
|
| VCID-cffy-8xw4-6ygm | Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-17463
|
| VCID-chhe-fut5-juaj | Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-6068
|
| VCID-cmry-884u-e3fb | Type confusion in JavaScript in Google Chrome prior to 67.0.3396.87 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6149
|
| VCID-cq2q-tjmf-9bh3 | security update |
CVE-2017-5126
|
| VCID-czdn-xk9m-3feb | Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. |
CVE-2018-6070
|
| VCID-d1m2-jgxs-a7bg | A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2018-17470
|
| VCID-d4ec-bfau-rqf9 | security update |
CVE-2017-5122
|
| VCID-dkgg-kr7c-27c1 | Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
CVE-2018-6155
|
| VCID-dmh2-49fa-juhr | A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-16079
|
| VCID-dsyp-zj1q-jugq | Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-6056
|
| VCID-dx77-2pgn-ekfr | security update |
CVE-2017-5102
|
| VCID-e422-cnwe-7yhv | Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6085
|
| VCID-e8pt-bavh-hfg4 | Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page. |
CVE-2018-6097
|
| VCID-ecwu-t846-j3cy | An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. |
CVE-2018-6120
|
| VCID-efx3-kvq7-ybhh | security update |
CVE-2017-5091
|
| VCID-ehpp-anxn-ayeb | Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to obtain memory metadata from privileged processes . |
CVE-2018-6080
|
| VCID-ej31-z8zt-vqav | Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6131
|
| VCID-eu6v-xqpf-ykgv | security update |
CVE-2017-15398
|
| VCID-ez1s-r157-5ugy | Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6141
|
| VCID-f86a-j5tb-93cq | security update |
CVE-2017-15425
|
| VCID-f8k3-7hyk-rqay | Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
CVE-2018-17476
|
| VCID-fa45-v8kf-eber | security update |
CVE-2017-15423
|
| VCID-fhph-2ebn-q7fa | security update |
CVE-2017-5110
|
| VCID-fm6x-yd2a-augs | Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
CVE-2018-6145
|
| VCID-fmrq-kjra-h7de | security update |
CVE-2018-6032
|
| VCID-fs3q-9wxj-nuhr | security update |
CVE-2018-6041
|
| VCID-fxpm-9gtc-hfha | Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2018-6135
|
| VCID-fye2-mh1u-1fa9 | security update |
CVE-2018-6040
|
| VCID-fzyq-ftn6-7fab | A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page. |
CVE-2018-16088
|
| VCID-g28k-c6ju-s7dt | The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction. |
CVE-2018-6152
|
| VCID-gbng-fr43-cuda | An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-16083
|
| VCID-ge6z-eg3f-fkh9 | Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2018-6127
|
| VCID-h3ac-ezjh-83f9 | Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
CVE-2018-16064
|
| VCID-h3r2-p2st-j3d1 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6167
|
| VCID-h5nz-g182-wfae | Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6150
|
| VCID-h6d9-931h-x7cy | A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6153
|
| VCID-h78x-7w36-wyhf | Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6174
|
| VCID-hhme-cs57-3bh4 | security update |
CVE-2017-15411
|
| VCID-hkax-gctv-9fdd | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6105
|
| VCID-hpsx-f2a5-eqad | Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
CVE-2018-6117
|
| VCID-hqjd-5tb1-qbby | security update |
CVE-2017-5128
|
| VCID-ht1f-rnkk-p7d7 | Insufficient data validation in filesystem URIs in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
CVE-2018-17460
|
| VCID-hyu6-vt7r-pqdz | An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-6072
|
| VCID-jatw-e1ev-y7bb | security update |
CVE-2017-5108
|
| VCID-jb7r-yhcp-1fac | security update |
CVE-2017-5092
|
| VCID-jdk2-ax9n-43er | Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
CVE-2018-6159
|
| VCID-jf58-eqc5-s7cf | security update |
CVE-2017-5129
|
| VCID-jhqn-7me5-47gm | A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash. |
CVE-2018-6126
|
| VCID-jn3c-hr5r-vugh | Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
CVE-2018-17465
|
| VCID-jscg-76my-9yga | Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page. |
CVE-2018-17468
|
| VCID-jshg-pqf7-xqc5 | An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. |
CVE-2018-6088
|
| VCID-jtsc-xwzs-ybd5 | security update |
CVE-2017-15387
|
| VCID-jv72-muuk-x7bb | Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-17467
|
| VCID-jvyg-7tdf-wkbs | security update |
CVE-2017-5116
|
| VCID-k4u2-7pgj-u7ea | Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page. |
CVE-2018-6074
|
| VCID-k5fp-sk85-rqgx | Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process. |
CVE-2018-6147
|
| VCID-k5mz-dk8t-cqhw | security update |
CVE-2017-5105
|
| VCID-k88j-kwax-ryfz | Type confusion in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
CVE-2018-6157
|
| VCID-ke9x-6mj8-t7ex | Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-17474
|
| VCID-kede-jwvw-8qfj | Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6093
|
| VCID-kjv8-mpnk-yqgm | Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. |
CVE-2018-6151
|
| VCID-kn4p-mggn-akea | security update |
CVE-2018-6034
|
| VCID-krd5-vewz-vqcr | Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page. |
CVE-2018-6110
|
| VCID-krz9-e85r-mbbx | Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2018-16073
|
| VCID-kzy9-wkqc-kqae | security update |
CVE-2018-6037
|
| VCID-m2w3-st4t-u3ey | security update |
CVE-2017-5114
|
| VCID-m5n2-r7pr-xue8 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page. |
CVE-2018-6108
|
| VCID-m6d9-mqnb-pfem | A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server. |
CVE-2018-6101
|
| VCID-m7p2-qd7r-uqfb | security update |
CVE-2017-5100
|
| VCID-med2-sczx-syfz | Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2017-15428
|
| VCID-mmxu-t72n-gya8 | Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2018-16074
|
| VCID-mp6g-cz3s-uuee | Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
CVE-2018-6129
|
| VCID-msa2-cu1k-pbhk | Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction. |
CVE-2018-6075
|
| VCID-mtmw-apkw-bkcu | Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16070
|
| VCID-mu54-gbev-suhp | A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-6170
|
| VCID-mu8x-cyee-6yfj | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6098
|
| VCID-myh1-r2p3-7qcd | chromium-browser: Type confusion in V8 |
CVE-2018-6122
|
| VCID-n188-wtvf-5feb | security update |
CVE-2017-15427
|
| VCID-n2sq-q2xm-jyg2 | security update |
CVE-2017-5124
|
| VCID-n2t8-vhr3-nyhd | Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension. |
CVE-2018-6178
|
| VCID-n9av-wxe6-6kct | Insufficient file type enforcement in Extensions API in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted Chrome Extension. |
CVE-2018-6176
|
| VCID-ndy1-k2yu-rfft | security update |
CVE-2018-6036
|
| VCID-ngwn-48qn-ekbj | Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6162
|
| VCID-nq6h-bfsv-7ucb | An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-17457
|
| VCID-ntrd-tzk9-guek | Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6094
|
| VCID-nx85-8qzx-pyhn | security update |
CVE-2018-6031
|
| VCID-nyff-nkfe-sufv | security update |
CVE-2017-15388
|
| VCID-p1hj-akhm-x7bf | security update |
CVE-2017-5103
|
| VCID-p2yx-2bxx-xkg3 | security update |
CVE-2017-5094
|
| VCID-p595-4zfc-27h7 | A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
CVE-2018-6116
|
| VCID-p6bv-nftb-mkgd | security update |
CVE-2018-6050
|
| VCID-p88r-hzrk-hqgc | security update |
CVE-2017-15396
|
| VCID-p9kc-u9kh-9qfs | Insufficient data validation in WebGL in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6154
|
| VCID-pb4j-zbun-5bcp | Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page. |
CVE-2018-6114
|
| VCID-pt8j-v3wj-m3bs | Insufficient policy enforcement in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
CVE-2018-6161
|
| VCID-q2d8-n1kf-tff4 | Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-17464
|
| VCID-q4ab-k3wy-sude | A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. |
CVE-2018-17466
|
| VCID-q5f1-zc92-6uez | A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-16065
|
| VCID-q7ws-e631-3qd6 | Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6100
|
| VCID-qcdr-4sku-f7dx | readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page. |
CVE-2018-6109
|
| VCID-qcyu-z7ed-fbf2 | Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-17469
|
| VCID-qer4-6csd-ykh3 | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
CVE-2018-6078
|
| VCID-qhfm-7tk4-qkfp | A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16085
|
| VCID-qhj8-6nsk-xkdm | security update |
CVE-2017-5113
|
| VCID-qkv7-ygu7-47a3 | Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. |
CVE-2018-16435
|
| VCID-qky9-sx2t-nkb7 | security update |
CVE-2018-6038
|
| VCID-qp1r-q1w2-9fey | security update |
CVE-2017-15419
|
| VCID-qrn9-ejvr-rkdp | security update |
CVE-2018-6119
|
| VCID-qtd9-yjz4-nkbm | security update |
CVE-2018-6039
|
| VCID-qyeg-tyc7-yfb8 | Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6143
|
| VCID-r7dh-2xw6-bqht | An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2018-6092
|
| VCID-rdd4-8duv-j7c8 | Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. |
CVE-2018-6179
|
| VCID-rdkc-z6p1-vkc8 | CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6137
|
| VCID-rege-9hcr-dugv | Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6077
|
| VCID-rphx-g7s7-b7au | security update |
CVE-2017-15424
|
| VCID-s169-487s-4yf2 | security update |
CVE-2018-6051
|
| VCID-s1cy-fw8e-ryhz | security update |
CVE-2018-6045
|
| VCID-s7n7-nmj5-z7de | security update |
CVE-2017-15420
|
| VCID-s8ts-yscy-2qa1 | security update |
CVE-2017-5115
|
| VCID-sbw4-2zc2-zyhj | Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page. |
CVE-2018-16077
|
| VCID-sppb-vbjn-57em | security update |
CVE-2017-5099
|
| VCID-sw83-fygy-p3a3 | security update |
CVE-2017-15407
|
| VCID-sy82-fp7s-kbfm | security update |
CVE-2017-5104
|
| VCID-szke-ezw4-abhq | Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page. |
CVE-2018-6057
|
| VCID-t1zr-ba6e-dyew | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6133
|
| VCID-t8z9-724b-kbdv | An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
CVE-2018-16082
|
| VCID-thb1-5pn1-qke9 | security update |
CVE-2017-15413
|
| VCID-thbk-ds17-qffv | A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
CVE-2018-6099
|
| VCID-tkcv-3v2r-xbat | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. |
CVE-2018-4117
|
| VCID-tm1p-cv2x-dkaz | An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. |
CVE-2018-6106
|
| VCID-u2xj-7wrk-rbc2 | Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-17475
|
| VCID-u5mr-9zjx-2kcw | chromium-browser: Overly permissive policy in WebUSB |
CVE-2018-6125
|
| VCID-ufrb-w7zg-17hr | A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. |
CVE-2018-6118
|
| VCID-ukea-49hj-47g9 | security update |
CVE-2017-5088
|
| VCID-umd1-uggc-yfhg | security update |
CVE-2017-15389
|
| VCID-umqx-zkqu-fbgw | security update |
CVE-2017-5117
|
| VCID-uq8x-zwaq-1ufw | Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6063
|
| VCID-uqfw-gwfb-4qd3 | Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
CVE-2018-16078
|
| VCID-uv96-qbvv-pfd8 | Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-6142
|
| VCID-uvr2-um2a-wbbn | A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16066
|
| VCID-uydn-waz1-2qb1 | A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16067
|
| VCID-uzqq-6sa3-gua9 | security update |
CVE-2017-15399
|
| VCID-v9zd-h4mu-8kbw | security update |
CVE-2018-6054
|
| VCID-vbsj-kvst-s7dw | Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
CVE-2018-6148
|
| VCID-vv1t-dnza-e7ee | security update |
CVE-2017-5131
|
| VCID-vyse-q5qv-ykdq | Use after free in Bluetooth in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. |
CVE-2018-6171
|
| VCID-w58g-f96r-dbh9 | security update |
CVE-2017-5107
|
| VCID-w6r6-gasp-tyh6 | XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page. |
CVE-2018-6081
|
| VCID-w7vb-24s7-nqed | security update |
CVE-2017-5095
|
| VCID-w7yy-wt4c-t3gh | Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. |
CVE-2018-6134
|
| VCID-wa42-kn9p-3yh6 | Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. |
CVE-2018-6144
|
| VCID-whtd-yh9c-abex | Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6164
|
| VCID-wt5v-pbx3-syc5 | security update |
CVE-2017-15406
|
| VCID-wu4g-ypkm-yud2 | Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6177
|
| VCID-x9r7-qzab-fugj | security update |
CVE-2018-6053
|
| VCID-xb15-27ya-9fdm | Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
CVE-2018-6165
|
| VCID-xddg-d819-nkcb | Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain local file data via a crafted HTML page. |
CVE-2018-16075
|
| VCID-xn7s-w5nb-e3aa | security update |
CVE-2017-5127
|
| VCID-xrwh-rb7f-n7ar | security update |
CVE-2017-5120
|
| VCID-y2b5-w2d4-2fhn | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
CVE-2018-17473
|
| VCID-ygqq-3xgf-hffg | Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6060
|
| VCID-yk6u-38ha-euh2 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
CVE-2018-6107
|
| VCID-ykcf-6hmv-1qfu | A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. |
CVE-2018-6103
|
| VCID-yrez-4r5z-c3d6 | security update |
CVE-2017-5109
|
| VCID-yu8b-u3bd-wba9 | An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6071
|
| VCID-z4n2-878u-j7f9 | Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
CVE-2018-6112
|
| VCID-z5kq-v33v-tfb3 | security update |
CVE-2017-5118
|
| VCID-zn4x-jwp2-d3b2 | A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6158
|
| VCID-zqzu-7cbw-q7a3 | Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6066
|
| VCID-zt1s-25sb-9bhr | security update |
CVE-2017-15409
|