Search for packages
| purl | pkg:deb/debian/chromium-browser@57.0.2987.98-1~deb8u1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-15jp-13mu-rkdj
Aliases: CVE-2017-15410 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-1cnq-45w5-jqbm
Aliases: CVE-2018-5179 |
A service worker can send the "activate" event on itself periodically which allows it to run perpetually. This would allow any malicious activity, such as logging an IP address by the service worker, to occur in the background. |
Affected by 33 other vulnerabilities. |
|
VCID-1ctt-s3cw-qkb2
Aliases: CVE-2018-6046 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-1err-b9xu-bffb
Aliases: CVE-2018-6111 |
An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-1j7y-gq69-4ybp
Aliases: CVE-2017-15394 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-1p9m-xmqn-kkem
Aliases: CVE-2018-6062 |
Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-1qje-s9xs-ekf4
Aliases: CVE-2018-6087 |
A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-1s3a-bb2s-xbhd
Aliases: CVE-2018-16086 |
Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-1sr5-ytxv-27dg
Aliases: CVE-2018-6104 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-1t4m-xz2y-j3cv
Aliases: CVE-2018-6079 |
Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-1tet-594z-b3ct
Aliases: CVE-2018-20346 |
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. | There are no reported fixed by versions. |
|
VCID-25qp-pnca-pyhz
Aliases: CVE-2018-6049 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2bzj-1pne-83df
Aliases: CVE-2017-5112 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2cy7-4k5v-5kdh
Aliases: CVE-2018-6065 |
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2dvf-u33m-f3f2
Aliases: CVE-2017-5111 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2jxw-zcmk-dubu
Aliases: CVE-2017-15408 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2m18-ueth-bfbx
Aliases: CVE-2018-18336 |
Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-2mzs-2qta-1ugx
Aliases: CVE-2018-6055 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2n4k-4knu-bqdj
Aliases: CVE-2018-17462 |
Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2p41-qmq6-77fj
Aliases: CVE-2017-15393 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2qbg-ms7n-t3ca
Aliases: CVE-2018-17479 |
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2qct-ke2t-h7gh
Aliases: CVE-2018-16084 |
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2qrb-4hnf-ekf5
Aliases: CVE-2018-6124 |
Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2s4d-3hm5-6qa9
Aliases: CVE-2018-17461 |
An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-2sjp-scq9-8fcg
Aliases: CVE-2018-6064 |
Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2t6u-4s2z-wudw
Aliases: CVE-2018-18347 |
Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-2ugy-4wxz-ybc7
Aliases: CVE-2017-15390 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-2vfg-4jns-rydh
Aliases: CVE-2018-6175 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-2vrs-fsx1-sucy
Aliases: CVE-2018-16069 |
Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-2wy8-j7nm-wfc5
Aliases: CVE-2017-15426 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-3cva-5z7z-xbag
Aliases: CVE-2018-6033 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-3ge9-8gdv-ffcd
Aliases: CVE-2018-6089 |
A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-3gv8-x494-8bgc
Aliases: CVE-2018-6073 |
A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-3jm1-1p6h-puht
Aliases: CVE-2018-6140 |
Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-3sd3-t64s-bqc2
Aliases: CVE-2017-15416 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-3sdy-uf9z-q7dt
Aliases: CVE-2018-6096 |
A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-3xs8-jccn-sker
Aliases: CVE-2018-6043 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-41jr-fnkg-pydt
Aliases: CVE-2017-5101 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-44xj-fq8m-gufp
Aliases: CVE-2018-16076 |
Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-45xp-bhkn-e7ft
Aliases: CVE-2018-6172 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-4bfj-yw9u-dbfv
Aliases: CVE-2018-6090 |
An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-4yuz-wbmy-rqh1
Aliases: CVE-2018-16071 |
A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 33 other vulnerabilities. |
|
VCID-583t-kjva-f7cr
Aliases: CVE-2018-6052 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-5fgs-wt33-eyf6
Aliases: CVE-2018-6136 |
Missing type check in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-5h7d-bfpp-p7dq
Aliases: CVE-2018-20068 |
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-5jw7-hptk-zueg
Aliases: CVE-2017-5125 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-5mfq-37jx-z3gk
Aliases: CVE-2017-15395 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-5mkd-c4p2-bbdr
Aliases: CVE-2018-18341 |
An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-5vgh-nww9-7uhk
Aliases: CVE-2017-5133 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-5vna-88ab-53fp
Aliases: CVE-2018-6130 |
Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-5vy8-u256-x7aa
Aliases: CVE-2017-15418 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-5wdt-bjtf-j7c4
Aliases: CVE-2018-6035 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-62ce-hpjg-33hp
Aliases: CVE-2018-6086 |
A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-64q6-pxyg-mkay
Aliases: CVE-2018-16080 |
A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-6bjh-5yq5-nfgn
Aliases: CVE-2018-6095 |
Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-6cj3-5ten-rfbr
Aliases: CVE-2018-16068 |
Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-6gtu-v8r3-cuf8
Aliases: CVE-2018-6156 |
Incorrect derivation of a packet length in WebRTC caused heap corruption via a crafted video file. This resulted in a potentially exploitable crash. |
Affected by 33 other vulnerabilities. |
|
VCID-6me3-vj15-vkc8
Aliases: CVE-2017-7000 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-6w5b-4328-fke8
Aliases: CVE-2018-6163 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-6zdk-89nb-1ffe
Aliases: CVE-2017-5098 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-79mj-2cnn-u3em
Aliases: CVE-2018-18349 |
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. | There are no reported fixed by versions. |
|
VCID-7bpy-eggn-6bhq
Aliases: CVE-2018-18350 |
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-7f8j-7qe5-5bf5
Aliases: CVE-2018-18337 |
Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-7k1a-3rg9-h3b3
Aliases: CVE-2018-17471 |
Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-7pup-vddx-2ke4
Aliases: CVE-2018-6048 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-7wcb-6byh-4qaf
Aliases: CVE-2017-5132 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-8121-a4t8-bycw
Aliases: CVE-2018-17459 |
Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-83xy-t5me-ybgj
Aliases: CVE-2018-6076 |
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-8422-j4v4-nyae
Aliases: CVE-2017-15417 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-84vd-1ca4-97cm
Aliases: CVE-2018-6113 |
Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-89dt-b2w8-uudk
Aliases: CVE-2018-18359 |
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-8frh-ktc6-j7cb
Aliases: CVE-2018-20071 |
Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-8ks7-jg52-qfd5
Aliases: CVE-2018-6047 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-8p6x-u2b3-53b1
Aliases: CVE-2018-6102 |
Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-8snc-rzpq-zube
Aliases: CVE-2017-5087 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-8u7y-6h25-cyef
Aliases: CVE-2018-6083 |
Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-8uxh-29xn-dkby
Aliases: CVE-2018-6173 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-8v8a-nkjg-c7cn
Aliases: CVE-2018-6132 |
Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. |
Affected by 33 other vulnerabilities. |
|
VCID-8wjg-twpp-kqe2
Aliases: CVE-2018-20066 |
Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-916d-s5dw-f3ej
Aliases: CVE-2018-17472 |
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-9658-h2hu-pyfs
Aliases: CVE-2017-5119 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-9859-av5h-67dr
Aliases: CVE-2018-18356 |
A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash. | There are no reported fixed by versions. |
|
VCID-9anb-j45p-e7fs
Aliases: CVE-2018-18358 |
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file. | There are no reported fixed by versions. |
|
VCID-9bfk-6qtv-xuej
Aliases: CVE-2018-18342 |
Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-9bnu-xy22-jka8
Aliases: CVE-2018-17478 |
Incorrect array position calculations in V8 in Google Chrome prior to 70.0.3538.102 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-9dbh-vb59-vfhb
Aliases: CVE-2018-6123 |
A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-9f7p-y8sr-q7d4
Aliases: CVE-2018-6069 |
Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-9hac-ppef-uke8
Aliases: CVE-2018-16087 |
Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-9j8q-uusr-n3bs
Aliases: CVE-2017-5121 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-9r67-rw19-pkda
Aliases: CVE-2017-15415 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-9vv9-95mg-p3hy
Aliases: CVE-2018-6042 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-a5dj-gr3k-wbff
Aliases: CVE-2017-15392 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-a5e9-2w7k-dbbp
Aliases: CVE-2018-17477 |
Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-a668-6xcg-87aj
Aliases: CVE-2018-6138 |
Insufficient policy enforcement in Extensions API in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-a89w-vw5y-5kbp
Aliases: CVE-2018-6168 |
Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-a96y-j7a9-1ugp
Aliases: CVE-2018-6067 |
Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ad8v-xc47-dye3
Aliases: CVE-2018-17480 |
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-ansp-3n1h-h3bk
Aliases: CVE-2017-5097 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-aqbp-cuvp-zkf2
Aliases: CVE-2018-6139 |
Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-aqds-4gea-kkde
Aliases: CVE-2017-15391 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-atft-p3jp-qyb4
Aliases: CVE-2018-6061 |
A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-avaa-wuk5-2ub1
Aliases: CVE-2018-17458 |
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ax2w-7j4x-xqh7
Aliases: CVE-2017-5106 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-b78z-k8bn-abfs
Aliases: CVE-2018-6082 |
Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-bacr-j553-s3bf
Aliases: CVE-2017-5093 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-bhp4-3tc7-vbb1
Aliases: CVE-2017-5089 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-bhwq-p16s-kkfe
Aliases: CVE-2018-20070 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-bsf6-2t9c-23hh
Aliases: CVE-2018-6169 |
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-c3hj-yrgy-9kd7
Aliases: CVE-2018-6121 |
Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-c4cz-sn45-vyhe
Aliases: CVE-2017-15386 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-c5ej-tb15-nugb
Aliases: CVE-2018-6091 |
Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-c6j5-gdub-s3fs
Aliases: CVE-2017-15429 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-c8fe-cn5e-ckac
Aliases: CVE-2018-16081 |
Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-c9jx-awwn-abfv
Aliases: CVE-2018-6166 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-cd6h-2n4f-sfbv
Aliases: CVE-2018-18352 |
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-cffy-8xw4-6ygm
Aliases: CVE-2018-17463 |
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-chhe-fut5-juaj
Aliases: CVE-2018-6068 |
Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-cmry-884u-e3fb
Aliases: CVE-2018-6149 |
Type confusion in JavaScript in Google Chrome prior to 67.0.3396.87 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-cq2q-tjmf-9bh3
Aliases: CVE-2017-5126 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-czdn-xk9m-3feb
Aliases: CVE-2018-6070 |
Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-d1m2-jgxs-a7bg
Aliases: CVE-2018-17470 |
A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-d4ec-bfau-rqf9
Aliases: CVE-2017-5122 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-dkgg-kr7c-27c1
Aliases: CVE-2018-6155 |
Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 33 other vulnerabilities. |
|
VCID-dmh2-49fa-juhr
Aliases: CVE-2018-16079 |
A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-dsyp-zj1q-jugq
Aliases: CVE-2018-6056 |
Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-dx77-2pgn-ekfr
Aliases: CVE-2017-5102 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-e422-cnwe-7yhv
Aliases: CVE-2018-6085 |
Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-e8pt-bavh-hfg4
Aliases: CVE-2018-6097 |
Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ecwu-t846-j3cy
Aliases: CVE-2018-6120 |
An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-efx3-kvq7-ybhh
Aliases: CVE-2017-5091 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-ehpp-anxn-ayeb
Aliases: CVE-2018-6080 |
Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to obtain memory metadata from privileged processes . |
Affected by 33 other vulnerabilities. |
|
VCID-ej31-z8zt-vqav
Aliases: CVE-2018-6131 |
Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-eu6v-xqpf-ykgv
Aliases: CVE-2017-15398 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-ez1s-r157-5ugy
Aliases: CVE-2018-6141 |
Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-f86a-j5tb-93cq
Aliases: CVE-2017-15425 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-f8k3-7hyk-rqay
Aliases: CVE-2018-17476 |
Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-fa45-v8kf-eber
Aliases: CVE-2017-15423 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-fhph-2ebn-q7fa
Aliases: CVE-2017-5110 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-fm6x-yd2a-augs
Aliases: CVE-2018-6145 |
Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-fmrq-kjra-h7de
Aliases: CVE-2018-6032 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-fs3q-9wxj-nuhr
Aliases: CVE-2018-6041 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-fxpm-9gtc-hfha
Aliases: CVE-2018-6135 |
Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-fye2-mh1u-1fa9
Aliases: CVE-2018-6040 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-fzyq-ftn6-7fab
Aliases: CVE-2018-16088 |
A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-g28k-c6ju-s7dt
Aliases: CVE-2018-6152 |
The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction. |
Affected by 33 other vulnerabilities. |
|
VCID-gbng-fr43-cuda
Aliases: CVE-2018-16083 |
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ge6z-eg3f-fkh9
Aliases: CVE-2018-6127 |
Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-h3ac-ezjh-83f9
Aliases: CVE-2018-16064 |
Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-h3r2-p2st-j3d1
Aliases: CVE-2018-6167 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-h5nz-g182-wfae
Aliases: CVE-2018-6150 |
Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-h6d9-931h-x7cy
Aliases: CVE-2018-6153 |
A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-h78x-7w36-wyhf
Aliases: CVE-2018-6174 |
Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-h7yf-6njg-t3bz
Aliases: CVE-2018-18353 |
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-h8nd-6jh8-cydc
Aliases: CVE-2018-20067 |
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-hhme-cs57-3bh4
Aliases: CVE-2017-15411 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-hkax-gctv-9fdd
Aliases: CVE-2018-6105 |
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-hnc5-k7ev-xbh7
Aliases: CVE-2018-17481 |
Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-hpsx-f2a5-eqad
Aliases: CVE-2018-6117 |
Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-hqjd-5tb1-qbby
Aliases: CVE-2017-5128 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-ht1f-rnkk-p7d7
Aliases: CVE-2018-17460 |
Insufficient data validation in filesystem URIs in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-hum1-axjp-9bgk
Aliases: CVE-2018-18354 |
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-hv7q-b723-nqar
Aliases: CVE-2018-20065 |
Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file. | There are no reported fixed by versions. |
|
VCID-hyu6-vt7r-pqdz
Aliases: CVE-2018-6072 |
An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-jatw-e1ev-y7bb
Aliases: CVE-2017-5108 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-jb7r-yhcp-1fac
Aliases: CVE-2017-5092 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-jdk2-ax9n-43er
Aliases: CVE-2018-6159 |
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-jf58-eqc5-s7cf
Aliases: CVE-2017-5129 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-jhqn-7me5-47gm
Aliases: CVE-2018-6126 |
A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash. |
Affected by 33 other vulnerabilities. |
|
VCID-jn3c-hr5r-vugh
Aliases: CVE-2018-17465 |
Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-jn9j-d88p-4fd4
Aliases: CVE-2018-18346 |
Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-jscg-76my-9yga
Aliases: CVE-2018-17468 |
Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-jshg-pqf7-xqc5
Aliases: CVE-2018-6088 |
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-jtsc-xwzs-ybd5
Aliases: CVE-2017-15387 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-jv72-muuk-x7bb
Aliases: CVE-2018-17467 |
Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-jvyg-7tdf-wkbs
Aliases: CVE-2017-5116 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-k4u2-7pgj-u7ea
Aliases: CVE-2018-6074 |
Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-k5fp-sk85-rqgx
Aliases: CVE-2018-6147 |
Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process. |
Affected by 33 other vulnerabilities. |
|
VCID-k5mz-dk8t-cqhw
Aliases: CVE-2017-5105 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-k88j-kwax-ryfz
Aliases: CVE-2018-6157 |
Type confusion in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 33 other vulnerabilities. |
|
VCID-ke9x-6mj8-t7ex
Aliases: CVE-2018-17474 |
Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-kede-jwvw-8qfj
Aliases: CVE-2018-6093 |
Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-kjv8-mpnk-yqgm
Aliases: CVE-2018-6151 |
Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-kn4p-mggn-akea
Aliases: CVE-2018-6034 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-krd5-vewz-vqcr
Aliases: CVE-2018-6110 |
Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-krz9-e85r-mbbx
Aliases: CVE-2018-16073 |
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-kzy9-wkqc-kqae
Aliases: CVE-2018-6037 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-m2w3-st4t-u3ey
Aliases: CVE-2017-5114 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-m5n2-r7pr-xue8
Aliases: CVE-2018-6108 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-m6d9-mqnb-pfem
Aliases: CVE-2018-6101 |
A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server. |
Affected by 33 other vulnerabilities. |
|
VCID-m7p2-qd7r-uqfb
Aliases: CVE-2017-5100 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-mcbg-jpmj-m3hr
Aliases: CVE-2018-18345 |
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-mdmz-nt6r-yucz
Aliases: CVE-2018-18343 |
Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-mdtr-2tyt-wyft
Aliases: CVE-2018-18338 |
Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-med2-sczx-syfz
Aliases: CVE-2017-15428 |
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-mmxu-t72n-gya8
Aliases: CVE-2018-16074 |
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-mp6g-cz3s-uuee
Aliases: CVE-2018-6129 |
Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-msa2-cu1k-pbhk
Aliases: CVE-2018-6075 |
Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction. |
Affected by 33 other vulnerabilities. |
|
VCID-mtmw-apkw-bkcu
Aliases: CVE-2018-16070 |
Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-mu54-gbev-suhp
Aliases: CVE-2018-6170 |
A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-mu8x-cyee-6yfj
Aliases: CVE-2018-6098 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-myh1-r2p3-7qcd
Aliases: CVE-2018-6122 |
chromium-browser: Type confusion in V8 |
Affected by 33 other vulnerabilities. |
|
VCID-n188-wtvf-5feb
Aliases: CVE-2017-15427 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-n2sq-q2xm-jyg2
Aliases: CVE-2017-5124 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-n2t8-vhr3-nyhd
Aliases: CVE-2018-6178 |
Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-n9av-wxe6-6kct
Aliases: CVE-2018-6176 |
Insufficient file type enforcement in Extensions API in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-ndy1-k2yu-rfft
Aliases: CVE-2018-6036 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-ngwn-48qn-ekbj
Aliases: CVE-2018-6162 |
Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-nq6h-bfsv-7ucb
Aliases: CVE-2018-17457 |
An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ntrd-tzk9-guek
Aliases: CVE-2018-6094 |
Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-nx85-8qzx-pyhn
Aliases: CVE-2018-6031 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-nyff-nkfe-sufv
Aliases: CVE-2017-15388 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-p1hj-akhm-x7bf
Aliases: CVE-2017-5103 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-p2yx-2bxx-xkg3
Aliases: CVE-2017-5094 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-p595-4zfc-27h7
Aliases: CVE-2018-6116 |
A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-p6bv-nftb-mkgd
Aliases: CVE-2018-6050 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-p88r-hzrk-hqgc
Aliases: CVE-2017-15396 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-p9kc-u9kh-9qfs
Aliases: CVE-2018-6154 |
Insufficient data validation in WebGL in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-pb4j-zbun-5bcp
Aliases: CVE-2018-6114 |
Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-prv4-j4e5-mqfj
Aliases: CVE-2018-18340 |
Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-pt8j-v3wj-m3bs
Aliases: CVE-2018-6161 |
Insufficient policy enforcement in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-q2d8-n1kf-tff4
Aliases: CVE-2018-17464 |
Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-q4ab-k3wy-sude
Aliases: CVE-2018-17466 |
A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. |
Affected by 33 other vulnerabilities. |
|
VCID-q59h-zpt1-c7bd
Aliases: CVE-2018-18348 |
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-q5f1-zc92-6uez
Aliases: CVE-2018-16065 |
A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-q7ws-e631-3qd6
Aliases: CVE-2018-6100 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-qcdr-4sku-f7dx
Aliases: CVE-2018-6109 |
readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-qcyu-z7ed-fbf2
Aliases: CVE-2018-17469 |
Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-qer4-6csd-ykh3
Aliases: CVE-2018-6078 |
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-qhfm-7tk4-qkfp
Aliases: CVE-2018-16085 |
A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-qhj8-6nsk-xkdm
Aliases: CVE-2017-5113 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-qkv7-ygu7-47a3
Aliases: CVE-2018-16435 |
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. |
Affected by 33 other vulnerabilities. |
|
VCID-qky9-sx2t-nkb7
Aliases: CVE-2018-6038 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-qp1r-q1w2-9fey
Aliases: CVE-2017-15419 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-qrn9-ejvr-rkdp
Aliases: CVE-2018-6119 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-qtd9-yjz4-nkbm
Aliases: CVE-2018-6039 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-qyeg-tyc7-yfb8
Aliases: CVE-2018-6143 |
Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-r7dh-2xw6-bqht
Aliases: CVE-2018-6092 |
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-rdd4-8duv-j7c8
Aliases: CVE-2018-6179 |
Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-rdkc-z6p1-vkc8
Aliases: CVE-2018-6137 |
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-rege-9hcr-dugv
Aliases: CVE-2018-6077 |
Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-rphx-g7s7-b7au
Aliases: CVE-2017-15424 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-s169-487s-4yf2
Aliases: CVE-2018-6051 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-s1cy-fw8e-ryhz
Aliases: CVE-2018-6045 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-s7n7-nmj5-z7de
Aliases: CVE-2017-15420 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-s8ts-yscy-2qa1
Aliases: CVE-2017-5115 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-sbw4-2zc2-zyhj
Aliases: CVE-2018-16077 |
Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-sppb-vbjn-57em
Aliases: CVE-2017-5099 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-sw83-fygy-p3a3
Aliases: CVE-2017-15407 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-sy82-fp7s-kbfm
Aliases: CVE-2017-5104 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-szke-ezw4-abhq
Aliases: CVE-2018-6057 |
Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-t1zr-ba6e-dyew
Aliases: CVE-2018-6133 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-t8z9-724b-kbdv
Aliases: CVE-2018-16082 |
An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-thb1-5pn1-qke9
Aliases: CVE-2017-15413 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-thbk-ds17-qffv
Aliases: CVE-2018-6099 |
A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-tkcv-3v2r-xbat
Aliases: CVE-2018-4117 |
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. |
Affected by 33 other vulnerabilities. |
|
VCID-tm1p-cv2x-dkaz
Aliases: CVE-2018-6106 |
An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-u2xj-7wrk-rbc2
Aliases: CVE-2018-17475 |
Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-u5mr-9zjx-2kcw
Aliases: CVE-2018-6125 |
chromium-browser: Overly permissive policy in WebUSB |
Affected by 33 other vulnerabilities. |
|
VCID-ufrb-w7zg-17hr
Aliases: CVE-2018-6118 |
A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-ukea-49hj-47g9
Aliases: CVE-2017-5088 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-umd1-uggc-yfhg
Aliases: CVE-2017-15389 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-umqx-zkqu-fbgw
Aliases: CVE-2017-5117 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-uq8x-zwaq-1ufw
Aliases: CVE-2018-6063 |
Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-uqfw-gwfb-4qd3
Aliases: CVE-2018-16078 |
Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-uv96-qbvv-pfd8
Aliases: CVE-2018-6142 |
Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-uvr2-um2a-wbbn
Aliases: CVE-2018-16066 |
A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-uydn-waz1-2qb1
Aliases: CVE-2018-16067 |
A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-uzqq-6sa3-gua9
Aliases: CVE-2017-15399 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-v9zd-h4mu-8kbw
Aliases: CVE-2018-6054 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-vbsj-kvst-s7dw
Aliases: CVE-2018-6148 |
Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-vcjj-2a4p-cycx
Aliases: CVE-2018-18355 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-vtyw-9eu6-3ydc
Aliases: CVE-2018-18351 |
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-vv1t-dnza-e7ee
Aliases: CVE-2017-5131 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-vyse-q5qv-ykdq
Aliases: CVE-2018-6171 |
Use after free in Bluetooth in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. |
Affected by 33 other vulnerabilities. |
|
VCID-w58g-f96r-dbh9
Aliases: CVE-2017-5107 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-w6r6-gasp-tyh6
Aliases: CVE-2018-6081 |
XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-w7vb-24s7-nqed
Aliases: CVE-2017-5095 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-w7yy-wt4c-t3gh
Aliases: CVE-2018-6134 |
Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-wa42-kn9p-3yh6
Aliases: CVE-2018-6144 |
Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. |
Affected by 33 other vulnerabilities. |
|
VCID-wa8e-7xwa-tba8
Aliases: CVE-2018-18357 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | There are no reported fixed by versions. |
|
VCID-whtd-yh9c-abex
Aliases: CVE-2018-6164 |
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-wt5v-pbx3-syc5
Aliases: CVE-2017-15406 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-wu4g-ypkm-yud2
Aliases: CVE-2018-6177 |
Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-x9r7-qzab-fugj
Aliases: CVE-2018-6053 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-xb15-27ya-9fdm
Aliases: CVE-2018-6165 |
Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-xddg-d819-nkcb
Aliases: CVE-2018-16075 |
Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain local file data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-xn7s-w5nb-e3aa
Aliases: CVE-2017-5127 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-xqrh-9yp4-zucn
Aliases: CVE-2018-18339 |
Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | There are no reported fixed by versions. |
|
VCID-xrwh-rb7f-n7ar
Aliases: CVE-2017-5120 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-y2b5-w2d4-2fhn
Aliases: CVE-2018-17473 |
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-ygqq-3xgf-hffg
Aliases: CVE-2018-6060 |
Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-yk6u-38ha-euh2
Aliases: CVE-2018-6107 |
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
Affected by 33 other vulnerabilities. |
|
VCID-ykcf-6hmv-1qfu
Aliases: CVE-2018-6103 |
A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-yrez-4r5z-c3d6
Aliases: CVE-2017-5109 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-yu8b-u3bd-wba9
Aliases: CVE-2018-6071 |
An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-z4n2-878u-j7f9
Aliases: CVE-2018-6112 |
Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-z5kq-v33v-tfb3
Aliases: CVE-2017-5118 |
security update |
Affected by 33 other vulnerabilities. |
|
VCID-z5rq-qtat-nqfy
Aliases: CVE-2018-18344 |
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension. | There are no reported fixed by versions. |
|
VCID-zjd9-mas9-4qa5
Aliases: CVE-2018-18335 |
A buffer overflow vulnerability in the Skia library can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. *Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.* | There are no reported fixed by versions. |
|
VCID-zn4x-jwp2-d3b2
Aliases: CVE-2018-6158 |
A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-zqzu-7cbw-q7a3
Aliases: CVE-2018-6066 |
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Affected by 33 other vulnerabilities. |
|
VCID-zt1s-25sb-9bhr
Aliases: CVE-2017-15409 |
security update |
Affected by 33 other vulnerabilities. |