Multiple vulnerabilities in Google Chrome

Description

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause a denial of service, bypass security restrictions, to spoof user interface, execute arbitrary code and perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. An unspecified vulnerability in the WebAssembly component can be exploited remotely by an unauthenticated attacker possibly to execute arbitrary code;
2. Unspecified vulnerabilities in the Skia component can be exploited remotely by unauthenticated attacker possibly to cause denial of service;
3. An unspecified vulnerability in LibXML2 can be exploited remotely by an unauthenticated attacker possibly to execute arbitrary code;
4. An unspecified vulnerability in the WebAudio component can be exploited remotely by an unauthenticated attacker possibly to execute arbitrary code;
5. An unspecified vulnerability in the WebGL component can be exploited remotely by an unauthenticated attacker possibly to execute arbitrary code;
6. Unspecified vulnerabilities in the PDFium component can be exploited remotely by unauthenticated attacker possibly to execute arbitrary code;
7. An unspecified vulnerability in the Skia component can be exploited remotely by unauthenticated attacker possibly to execute arbitrary code;
8. A vulnerability in Google Chrome and Chromium can be exploited remotely by unauthenticated attacker possibly to perform a universal cross-site scripting attack;
9. An unspecified vulnerability in the ImageCapture component can be exploited remotely by unauthenticated attacker possibly to cause denial of service;
10. An unspecified vulnerability in Extention UI can be exploited remotely by unauthenticated attacker possibly to spoof user interface;
11. An unspecified vulnerability in the DevTools component can be exploited remotely by unauthenticated attacker possibly to spoof user interface;
12. An unspecified vulnerability in PlatformIntegration can be exploited remotely by unauthenticated attacker possibly to spoof user interface;
13. An unspecified vulnerability in extensions can be exploited remotely by unauthenticated attacker possibly to bypass security restrictions;
14. Unspecified vulnerabilities in Omnibox can be exploited remotely by unauthenticated attacker possibly to spoof user interface;
15. An unspecified vulnerability in the Skia component can be exploited remotely by unauthenticated attacker possibly to cause denial of service;
16. A vulnerability in Google Chrome and Chromium can be exploited remotely by unauthenticated attacker possibly to bypass security restrictions;
17. An unspecified vulnerability in the Blink component can be exploited remotely by unauthenticated attacker possibly to spoof user interface;

---

Technical details

NB: This vulnerability does not have any public CVSS rating, so rating can be changed by the time.

NB: At this moment Google has just reserved CVE numbers for these vulnerabilities. Information can be changed soon.

Original advisories

• Stable Channel Update for Desktop

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Google-Chrome

CVE list

• CVE-2017-15388
  critical
• CVE-2017-15389
  high
• CVE-2017-15390
  high
• CVE-2017-15391
  high
• CVE-2017-15392
  warning
• CVE-2017-15393
  critical
• CVE-2017-15394
  high
• CVE-2017-15395
  high
• CVE-2017-5124
  high
• CVE-2017-5125
  critical
• CVE-2017-5126
  critical
• CVE-2017-5127
  critical
• CVE-2017-5128
  critical
• CVE-2017-5129
  critical
• CVE-2017-5132
  critical
• CVE-2017-5130
  critical
• CVE-2017-5131
  critical
• CVE-2017-5133
  critical
• CVE-2017-15386
  high
• CVE-2017-15387
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com