Weipeng Jiang

A type confusion issue exists in ANGLE (Almost Native Graphics Layer Engine), a compatibility layer between OpenGL ES and native graphics APIs. This flaw allows a remote attacker to potentially perform out-of-bounds memory access by inducing the browser to process a specially crafted HTML page.

A use after free issue exists in the Audio component. This allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape by using a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

An inappropriate implementation in V8 allows a remote attacker to potentially exploit heap corruption, which occurs when memory is allocated in the heap area is corrupted, via a crafted HTML page. This exploitation requires the attacker to convince a user to perform specific UI gestures.

An integer overflow in the Media component allows a remote attacker to execute arbitrary code within a sandbox by using a malicious file. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is too large to be stored in the allocated memory space.

An inappropriate implementation in Codecs allows a remote attacker to potentially perform a sandbox escape by using a crafted video file. A sandbox escape is a technique used to break out of a restricted environment to gain unauthorized access to the underlying system.

A type confusion issue exists in the Media component, which allows a remote attacker to execute arbitrary code within a sandbox by utilizing a specially crafted HTML page. Type confusion occurs when a program accesses a resource using a type that is different from the type it was originally allocated.

An inappropriate implementation in the Passwords component allows a remote attacker who has compromised the renderer process to obtain potentially sensitive information from process memory by using a crafted HTML page.

An inappropriate implementation in Safe Browsing allows a remote attacker to bypass discretionary access control, which is a security mechanism that restricts access to objects based on the identity of users or groups, by using a crafted RAR file.

A use after free issue in Glic allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape. This is achieved through the use of a crafted HTML page.

A use after free issue exists in the ServiceWorker component. This occurs when a user is convinced to install a malicious extension, allowing an attacker to execute arbitrary code through a crafted Chrome Extension. Use after free is a memory corruption flaw that happens when an application continues to use a pointer after it has been freed.

Out of bounds memory access in Skia allows a remote attacker to execute arbitrary code inside a sandbox by using a crafted HTML page. Out of bounds memory access occurs when a program reads or writes data outside the boundaries of the intended memory buffer.

A use after free issue exists in WebAuthentication. A remote attacker can potentially exploit heap corruption—a condition where memory allocation on the heap is corrupted—via a crafted HTML page, provided they can convince a user to perform specific UI gestures.

A use after free issue in Input allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

Insufficient validation of untrusted input in Chromoting allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A sandbox escape is a technique used to break out of a restricted environment to gain unauthorized access to the underlying system.

A use after free issue in the UI allows a remote attacker to potentially exploit heap corruption, which occurs when a program continues to use a pointer after it has been freed, by using a crafted HTML page.

An inappropriate implementation in the Password Manager allows a remote attacker to leak cross-origin data, which is data from a different domain than the one that initiated the request, by using a crafted HTML page.

A use after free issue in the TabStrip component allows a remote attacker to execute arbitrary code when a user opens a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue in Blink allows a remote attacker to execute arbitrary code inside a sandbox by using a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue exists in WebRTC, which allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue exists in the Touchbar component on Mac. This flaw allows a remote attacker to potentially achieve a sandbox escape by inducing the user to visit a specially crafted HTML page. A use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.