Asnine

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in LocalNetworkAccess within Google Chrome. A crafted HTML page could allow a remote attacker to bypass navigation restrictions. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

The issue allows a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. This is due to an out of bounds read in PDFium in Google Chrome. The severity of this issue is classified as medium by Chromium.

The issue is related to a use after free vulnerability in the Navigation function of Google Chrome and Microsoft Edge browsers. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension, potentially leading to remote code execution or denial of service. The severity of this issue is considered high.

A use-after-free issue existed in the Extensions component of Google Chrome. This allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. The security severity is rated as Medium.

The issue is related to an elevation of privilege vulnerability in Microsoft Edge, which is based on Chromium. This vulnerability can be exploited by a remote attacker to elevate their privileges. The vulnerability is associated with access control errors.

The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. The severity of this issue is classified as Medium by Chromium security.

The issue is related to a use after free in WebRTC, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.

The issue is related to a use after free in DevTools, allowing a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The attacker can use a specially crafted HTML page to exploit this issue.

The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. This could potentially lead to access to confidential data, disruption of data integrity, and denial of service.

The issue is related to the use of memory after it has been freed in the Guest View mode of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by using a specially crafted HTML page. An attacker who convinces a user to install a malicious extension could potentially exploit heap corruption.

The issue is related to a heap buffer overflow in the Network Service of Google Chrome, which could be exploited by an attacker who convinces a user to install a malicious extension. This exploitation could potentially lead to heap corruption via a crafted HTML page and specific interactions. The severity of this issue is considered high.

The issue is related to insufficient validation of untrusted input, which can be exploited by a remote attacker to bypass download restrictions via a malicious file. This could potentially allow the attacker to disclose protected information.

The issue is related to a use after free in Blink, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page. This may impact the confidentiality, integrity, and availability of protected information.

A remote code execution issue exists due to the way Microsoft scripting engines handle objects in memory, potentially allowing an attacker to execute arbitrary code in the context of the current user. This could be achieved by corrupting memory, and if the current user has administrative rights, an attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.