Ehsan Akhgari

Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code.

The issue is related to improper control of a web worker's ability to create a WebSocket object, allowing remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code. This can be exploited by a remote attacker using specially formed JavaScript code to bypass existing access restrictions.

The issue is related to errors in security settings, allowing a remote attacker to bypass CORS protection mechanisms. This can be achieved by either duplicating cache-key sequences or retrieving values from an incorrect HTTP Access-Control-* response header.

The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory due to an untrusted search path vulnerability.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.