Koocola

يؤدي فقدان التفويض في مكون BackgroundFetch إلى السماح لمهاجم عن بُعد بتجاوز سياسة أصل الويب، وهي آلية أمنية تقيد كيفية تفاعل مستند أو نص برمجي محمل من أصل معين مع مورد من أصل آخر، وذلك عبر صفحة HTML مصممة خصيصاً.

تسمح ثغرة القراءة خارج الحدود (out-of-bounds read) في Permissions لمهاجم عن بُعد تمكن من اختراق عملية التصيير (renderer process) بتنفيذ رمز عشوائي محتمل خارج صندوق الحماية (sandbox) عبر صفحة HTML مصممة خصيصاً. تحدث القراءة خارج الحدود عندما يقرأ البرنامج بيانات تتجاوز نهاية المخزن المؤقت (buffer) المحدد، مما قد يؤدي إلى تلف الذاكرة أو تسريب المعلومات.

A maliciously crafted ZIP archive may bypass Gatekeeper checks. This issue was addressed with improved checks.

The issue is related to insufficient data validation in Permission Prompts, which can be exploited by a remote attacker to install a malicious app and potentially perform a sandbox escape using a specially crafted file. This could allow the attacker to execute code outside the isolated software environment.

The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code.

The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code.

The issue is related to a use after free in the Nearby Share function, which could allow a remote attacker to exploit heap corruption via specific UI interactions if the user is convinced to engage in specific actions. This could potentially lead to arbitrary code execution with the help of a specially crafted web page.

The issue is related to a use after free in the printing function of the browsers, which can lead to heap corruption. A remote attacker who convinces the user to engage in specific interactions can potentially exploit this issue via a crafted HTML page. This could allow the attacker to execute arbitrary code.

The issue is related to a use after free vulnerability in the Extensions API of Google Chrome, which can lead to heap corruption. An attacker could potentially exploit this by convincing a user to install a malicious extension and then using a crafted HTML page. This could allow the attacker to execute arbitrary code remotely.

The issue is related to a use after free vulnerability in the Bookmarks component of Google Chrome. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted HTML page. An attacker who convinces a user to install a malicious extension could potentially exploit heap corruption.

The issue is related to a use after free in IndexedDB, which could allow an attacker to potentially perform a sandbox escape via a crafted Chrome Extension if a user is convinced to install a malicious extension. It may also enable a remote attacker to gain unauthorized access to protected information using a specially crafted web page.