Koocola

Missing authorization in the BackgroundFetch component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin, by using a crafted HTML page.

An out-of-bounds read in Permissions allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. An out-of-bounds read occurs when a program reads data past the end of the intended buffer, which can lead to memory corruption or information disclosure.

A maliciously crafted ZIP archive may bypass Gatekeeper checks. This issue was addressed with improved checks.

The issue is related to insufficient data validation in Permission Prompts, which can be exploited by a remote attacker to install a malicious app and potentially perform a sandbox escape using a specially crafted file. This could allow the attacker to execute code outside the isolated software environment.

The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code.

The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code.

The issue is related to a use after free in the Nearby Share function, which could allow a remote attacker to exploit heap corruption via specific UI interactions if the user is convinced to engage in specific actions. This could potentially lead to arbitrary code execution with the help of a specially crafted web page.

The issue is related to a use after free in the printing function of the browsers, which can lead to heap corruption. A remote attacker who convinces the user to engage in specific interactions can potentially exploit this issue via a crafted HTML page. This could allow the attacker to execute arbitrary code.

The issue is related to a use after free vulnerability in the Extensions API of Google Chrome, which can lead to heap corruption. An attacker could potentially exploit this by convincing a user to install a malicious extension and then using a crafted HTML page. This could allow the attacker to execute arbitrary code remotely.

The issue is related to a use after free vulnerability in the Bookmarks component of Google Chrome. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted HTML page. An attacker who convinces a user to install a malicious extension could potentially exploit heap corruption.

The issue is related to a use after free in IndexedDB, which could allow an attacker to potentially perform a sandbox escape via a crafted Chrome Extension if a user is convinced to install a malicious extension. It may also enable a remote attacker to gain unauthorized access to protected information using a specially crafted web page.