Multiple vulnerabilities in Google Chrome

Description

Multiple serious vulnerabilities have been found in Google Chrome versions earlier than 59.0.3071.86. Malicious users can exploit these vulnerabilities possibly to cause a denial of service, execute arbitrary code, bypass security restrictions and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Type confusion in V8 can be exploited remotely possibly to obtain sensitive information or execute arbitrary code;
2. Out-of-bounds read in V8 can be exploited remotely by an unauthenticated attacker possibly to cause a denial of service;
3. An unspecified vulnerability in Omnibox can be exploited remotely possibly spoof addresses;
4. Use-after-free vulnerability in print preview can be exploited remotely possibly to execute arbitrary code or cause a denial of service;
5. Use-after-free vulnerability in Apps Bluetooth can be exploited remotely possibly to obtain sensitive information or cause a denial of service;
6. An unspecified vulnerability in CSP reporting can be exploited remotely possibly to obtain sensitive information;
7. Multiple unspecified vulnerabilities in Omnibox can be exploited remotely possibly to spoof user interface;
8. Heap buffer overflow in Skia can be exploited remotely possibly to cause a denial of service;
9. An improper mailto handling can be exploited remotely possibly to execute arbitrary code;
10. Multiple unspecified vulnerabilities in Blink can be exploited remotely to spoof user interface;
11. Use-after-free vulnerability in credit card autofill can be exploited remotely possibly to execute arbitrary code;
12. An unspecified vulnerability can be exploited remotely possibly to bypass extension verification;
13. Insufficient hardening in credit card editor can be exploited remotely by an unauthenticated user with an unspecified impact;
14. Improper JavaScript code execution on WebUI pages can be exploited remotely possibly to obtain sensitive information or spoof user interface.

NB: These vulnerabilities do not have any public CVSS rating so rating can be changed by the time.

NB: At this moment Google has just reserved CVE numbers for thess vulnerabilities. Information can be changed soon.

Original advisories

• Stable Channel Update for Desktop

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Google-Chrome

CVE list

• CVE-2017-5087
  high
• CVE-2017-5088
  high
• CVE-2017-5089
  warning
• CVE-2017-5076
  warning
• CVE-2017-5077
  high
• CVE-2017-5078
  high
• CVE-2017-5079
  warning
• CVE-2017-5080
  high
• CVE-2017-5081
  warning
• CVE-2017-5083
  warning
• CVE-2017-5086
  warning
• CVE-2017-5070
  high
• CVE-2017-5071
  high
• CVE-2017-5073
  high
• CVE-2017-5074
  high
• CVE-2017-5075
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com