Avaue

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 109.0.5414.119 **Description** The issue is related to a use after free in GuestView, which could potentially allow an attacker to exploit heap corruption via a Chrome web app if a user is convinced to install a malicious extension. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service, potentially through a specially crafted HTML page. **Recommendations** For Google Chrome versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions until the update is applied. Restrict access to Chrome web apps to minimize the risk of exploitation. Avoid using Chrome with untrusted or malicious extensions.

**Name of the Vulnerable Software and Affected Versions** Google Chrome on Chrome OS versions prior to 109.0.5414.74 **Description** The issue is related to a heap buffer overflow in Platform Apps, which could be exploited by an attacker who convinces a user to install a malicious extension. This could potentially lead to heap corruption via a crafted HTML page. The attacker, acting remotely, could install arbitrary extensions using a specially crafted HTML page. **Recommendations** For Google Chrome on Chrome OS versions prior to 109.0.5414.74, update to version 109.0.5414.74 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to minimize the risk of exploitation. Avoid using crafted HTML pages that could trigger the heap buffer overflow until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 99.0.4844.74 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free in the Safe Browsing feature, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This might enable the attacker to execute arbitrary code or cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Google Chrome versions prior to 99.0.4844.74, update to version 99.0.4844.74 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 98.0.4758.80 **Description** The issue is related to a use after free in the Safe Browsing feature, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could enable the attacker to bypass existing security restrictions. **Recommendations** For Google Chrome versions prior to 98.0.4758.80, update to version 98.0.4758.80 or later to resolve the issue.