KLA10818
Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Multiple unknown vulnerabilities can be exploited remotely to cause denial of service or possibly have other unknown impacts;
2. An improper interval count validation at Skia can be exploited remotely to cause denial of service via a specially designed serialized data;
3. An improper autofill implementation can be exploited remotely via a specially designed web site to cause denial of service or possibly have another unknown impact;
4. An improper extension views handling can be exploited remotely via vectors related to extensions to cause a denial of service or possibly have another unspecified impact;
5. Lack of URL restrictions at Blink can be exploited remotely to cause denial of service via vectors related to extensions or possibly have another unknown impact;
6. Lack of module types validation at extensions bindings can be exploited via custom types manipulations to bypass security restrictions or obtain sensitive information;
7. Lack of frame navigation restrictions can be exploited remotely via a specially designed JavaScript code to bypass same origin policy;
8. Lack of access restrictions can be exploited remotely to bypass same origin policy.

Technical details

Vulnerability (2) related to SkRegion::readFromMemory function from core/SkRegion.cpp. This function does not validate the interval count.

Vulnerability (3) caused by mishandling interaction between field updates and JavaScript code that triggers a frame deletion.

Vulnerability (4) related to extensions/renderer/runtime_custom_bindings.cc which does not consider side effects during creation of an array of extension views.

Vulnerability (5) related to WebKit/Source/devtools/front_end/devtools.js at the Developer Tools subsystem. Vulnerability caused by lack of check that remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL.

Vulnerability (6) related to createCustomType function in extensions/renderer/resources/binding.js which does not validate module types. As result of exploitation attacker can load arbitrary modules.

Vulnerability (7) related to FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp which does not prevent navigations during DocumentLoader detach operations.

Vulnerability (8) caused by lack of bindings access restrictions.

Google Chrome versions earlier than 51.0.2704.79 (All branches)

Update to the latest version.
Get Chrome