Multiple vulnerabilities in Google Chrome

Описание

Multiple serious vulnerabilities have been found in Google Chrome prior to 55.0.2883.75. Malicious users can exploit these vulnerabilities to bypass security restrictions, make code injections and possibly cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Incorrectly handled iframes in Blink can be exploited remotely via a specially designed HTML page to bypass security restrictions (a no-referrer policy);
2. A use-after-free vulnerability in PDFium can be exploited remotely to possibly cause a denial of service or obtain sensitive information;
3. Corruption of the DOM tree in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts;
4. Incorrect handling of deferred page loads in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts.

---

Technical details

Vulnerability (3) can be triggered by leaking of an SVG shadow tree.

Первичный источник обнаружения

• Stable Channel Update for Desktop
  

Связанные продукты

• Google-Chrome
• Google-Chrome-for-Android

Список CVE

• CVE-2016-5205
  warning
• CVE-2016-5204
  warning
• CVE-2016-5203
  high
• CVE-2016-9650
  warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com