Multiple vulnerabilities in Google Chrome

Description

Multiple serious vulnerabilities have been found in Google Chrome prior to 55.0.2883.75. Malicious users can exploit these vulnerabilities to bypass security restrictions, make code injections and possibly cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Incorrectly handled iframes in Blink can be exploited remotely via a specially designed HTML page to bypass security restrictions (a no-referrer policy);
2. A use-after-free vulnerability in PDFium can be exploited remotely to possibly cause a denial of service or obtain sensitive information;
3. Corruption of the DOM tree in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts;
4. Incorrect handling of deferred page loads in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts.

---

Technical details

Vulnerability (3) can be triggered by leaking of an SVG shadow tree.

Original advisories

• Stable Channel Update for Desktop

Related products

• Google-Chrome
• Google-Chrome-for-Android

CVE list

• CVE-2016-5205
  warning
• CVE-2016-5204
  warning
• CVE-2016-5203
  high
• CVE-2016-9650
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com