Darknavy

Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling.

The issue is related to improper logging in the fingerprint trustlet, allowing local privileged attackers to obtain a `hmac key`. This can be exploited by attackers with local privileges.

The issue is an out-of-bounds read in the fingerprint trustlet, allowing local privileged attackers to read out-of-bounds memory.

The issue is related to improper access control in the fingerprint trustlet, allowing local privileged attackers to obtain an `auth token`. This can be exploited by attackers with local access and privileges.

The issue is an out-of-bounds write in the Keymaster trustlet, allowing local privileged attackers to write out-of-bounds memory. This can be exploited by local privileged attackers.

The issue is related to a configuration vulnerability in the OpenSSH service for Windows, specifically with the `-Oallow-remote-pkcs11` option for the ssh-agent cryptographic protection tool. This vulnerability is associated with incorrect external management of a file name or path, allowing a remote attacker to execute arbitrary code by loading a malicious DLL library. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to a use-after-free vulnerability in the Artificial Intelligence (AI) technology of Google Chrome and Microsoft Edge browsers. This vulnerability can be exploited by a remote attacker via a crafted HTML page, potentially allowing them to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with heap corruption.

The issue is related to out of bounds memory access in Compositing, allowing a remote attacker who has compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. This could enable the attacker to execute arbitrary code using a specially crafted web page.

The issue is related to insufficient data validation in USB in Google Chrome, allowing a remote attacker to perform out of bounds memory access via a crafted HTML page. This could potentially enable the attacker to execute arbitrary code. The severity of this issue is considered high.

The issue is related to an integer overflow in the USB interface of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to execute arbitrary code. The severity of this issue is classified as High by Chromium.

The issue is related to a use after free vulnerability in the Cast component of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page to potentially compromise the renderer process and exploit heap corruption.

The issue is related to an out of bounds memory access in the FedCM component of Google Chrome, allowing a remote attacker who has compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. This can potentially lead to the execution of arbitrary code. The severity of this issue is classified as High by Chromium security.