Description
Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions, spoof user interface, gain privileges, write local files and obtain sensitive information. Below is a complete list of vulnerabilities:
A stack buffer overflow vulnerability in Skia can be exploited remotely to execute arbitrary code and cause denial of service;
Multiple heap buffer overflow vulnerabilities in WebGL can be exploited remotely to execute arbitrary code and cause denial of service;
A use after free vulnerability in WebRTC can be exploited remotely to execute arbitrary code;
A heap buffer overflow vulnerability in WebRTC can be exploited remotely to execute arbitrary code and cause denial of service;
A use after free vulnerability in Blink can be exploited remotely to execute arbitrary code;
Multiple same origin policy bypass vulnerabilities in ServiceWorker can be exploited remotely to bypass security restrictions;
A same origin policy bypass vulnerability in WebAudio can be exploited remotely to bypass security restrictions;
Multiple URL spoof vulnerabilities in Omnibox can be exploited remotely to spoof user interface;
A CORS bypass vulnerabilities in Blink can be exploited remotely to bypass security restrictions;
A permission bypass vulnerability in extension installation can be exploited remotely to bypass security restrictions;
A type confusion vulnerability in PDFium can be exploited remotely to execute arbitrary code;
A use after free vulnerability in WebBluetooth can be exploited remotely to execute arbitrary code;
A integer overflow vulnerability in SwiftShader can be exploited remotely to cause denial of service;
An unspecified vulnerability in Extensions can be exploited remotely to gain privileges;
Multiple cross origin information leak vulnerabilities in Blink can be exploited remotely to obtain sensitive information;
A UI spoof vulnerability in Extensions can be exploited remotely to spoof user interface;
A local file information leak vulnerability in Extensions can be exploited remotely to obtain sensitive information;
A request privilege escalation vulnerability in Extensions can be exploited remotely to gain privileges;
A cross origin information disclosure in Service Workers can be exploited remotely to obtain sensitive information;
A local file write in DevTools can be exploited locally to write local files.
Original advisories
Exploitation
Public exploits exist for this vulnerability.
Related products
CVE list
- CVE-2018-4117 high
- CVE-2018-6169 high
- CVE-2018-6170 critical
- CVE-2018-6171 high
- CVE-2018-6172 high
- CVE-2018-6173 high
- CVE-2018-6174 critical
- CVE-2018-6175 high
- CVE-2018-6176 critical
- CVE-2018-6177 warning
- CVE-2018-6178 warning
- CVE-2018-6179 high
- CVE-2018-6044 warning
- CVE-2018-6150 high
- CVE-2018-6151 critical
- CVE-2018-6152 critical
- CVE-2018-6153 critical
- CVE-2018-6154 critical
- CVE-2018-6155 high
- CVE-2018-6156 critical
- CVE-2018-6157 critical
- CVE-2018-6158 critical
- CVE-2018-6159 high
- CVE-2018-6161 critical
- CVE-2018-6162 critical
- CVE-2018-6163 high
- CVE-2018-6164 high
- CVE-2018-6165 high
- CVE-2018-6166 high
- CVE-2018-6167 high
- CVE-2018-6168 high
- CVE-2018-6160 high
- CVE-2018-17460 high
- CVE-2018-17461 critical
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com