Jungwoo Lee

A use after free issue exists in the Autofill component. A remote attacker who has already compromised the renderer process can potentially achieve a sandbox escape by using a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue in WebMIDI allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

Script injection in the SanitizerAPI allows a remote attacker to inject arbitrary scripts or HTML, leading to Universal Cross-Site Scripting (UXSS), which is a vulnerability that allows an attacker to execute scripts across different origins, via a crafted HTML page.

An inappropriate implementation in Glic allows a remote attacker to bypass navigation restrictions by using a crafted HTML page.

A use after free issue exists in the Omnibox. A remote attacker can exploit heap corruption—a condition where memory allocation on the heap is corrupted—via a crafted HTML page, provided they can convince a user to perform specific UI gestures.

A use after free issue in Canvas allows a remote attacker to execute arbitrary code inside a sandbox by utilizing a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue in Chromoting allows a remote attacker to execute arbitrary code through malicious network traffic. Use after free occurs when an application continues to use a pointer after it has been freed, which can lead to crashes or unauthorized code execution.

An inappropriate implementation in the Downloads component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by using a crafted HTML page.

A use-after-free issue exists in the media component, specifically within the media parser. This occurs when the software continues to use a memory location after it has been freed. A remote attacker can exploit this by inducing the browser to load a specially crafted HTML page, potentially leading to arbitrary code execution inside a sandbox.

Insufficient policy enforcement in Web Bluetooth allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A sandbox escape is a technique used to break out of a restricted execution environment to gain unauthorized access to the underlying system.