Wongi Lee

A use after free issue exists in the Autofill component. A remote attacker who has already compromised the renderer process can potentially achieve a sandbox escape by using a specially crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue in WebMIDI allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

Script injection in the SanitizerAPI allows a remote attacker to inject arbitrary scripts or HTML, leading to Universal Cross-Site Scripting (UXSS), which is a vulnerability that allows an attacker to execute scripts across different origins, via a crafted HTML page.

An inappropriate implementation in Glic allows a remote attacker to bypass navigation restrictions by using a crafted HTML page.

A use after free issue exists in the Omnibox. A remote attacker can exploit heap corruption—a condition where memory allocation on the heap is corrupted—via a crafted HTML page, provided they can convince a user to perform specific UI gestures.

A use after free issue in Canvas allows a remote attacker to execute arbitrary code inside a sandbox by utilizing a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A use after free issue in Chromoting allows a remote attacker to execute arbitrary code through malicious network traffic. Use after free occurs when an application continues to use a pointer after it has been freed, which can lead to crashes or unauthorized code execution.

An inappropriate implementation in the Downloads component allows a remote attacker to perform UI spoofing, which is the act of mimicking a legitimate user interface to deceive users, by using a crafted HTML page.

A use-after-free issue exists in the media component, specifically within the media parser. This occurs when the software continues to use a memory location after it has been freed. A remote attacker can exploit this by inducing the browser to load a specially crafted HTML page, potentially leading to arbitrary code execution inside a sandbox.

Insufficient policy enforcement in Web Bluetooth allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A sandbox escape is a technique used to break out of a restricted execution environment to gain unauthorized access to the underlying system.

The issue is related to a NULL pointer dereference in the Linux kernel's vsock/virtio module. This can occur when the socket has been de-assigned or assigned to another transport, and packets are received that are not expected, causing issues when accessing `vsk->transport`. A possible scenario involves a first connect() interrupted by a signal, and a second connect() failed, leading to `vsk->transport` being NULL.

The issue is related to a use after free (UAF) vulnerability in the Linux kernel. It occurs when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by another ingress or clsact instance, causing the tcx entry to be released too early. The sequence to trigger the UAF involves creating a network namespace, allocating a tcx entry, and then replacing the qdisc, which frees the previously linked tcx entry. Later, when the network namespace is closed, it accesses the already freed tcx entry, leading to the UAF. The correct fix is to turn the miniq active boolean into a counter, ensuring the tcx entry is freed at the correct time.