Zhe Jin

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 83.0.4103.61 **Description** The issue is related to a use after free in Blink, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For versions prior to 83.0.4103.61, update to version 83.0.4103.61 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 83.0.4103.61 **Description** The issue is related to a use after free in the media component of Google Chrome, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service via a specially crafted HTML page. This can potentially allow the attacker to perform a sandbox escape if the renderer process is compromised. **Recommendations** For versions prior to 83.0.4103.61, update to version 83.0.4103.61 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable media components until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 81.0.4044.129 **Description** The issue is related to a use after free in storage, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape. This can be achieved via a crafted HTML page. The exploitation of this issue may allow an attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For versions prior to 81.0.4044.129, update to version 81.0.4044.129 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious HTML pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 81.0.4044.129 **Description** The issue is related to a use after free in task scheduling, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For Google Chrome versions prior to 81.0.4044.129, update to version 81.0.4044.129 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 81.0.4044.122 **Description** The issue is related to a use after free in the payments mechanism of Google Chrome, which can be exploited by a remote attacker via a crafted HTML page. This could potentially allow the attacker to exploit heap corruption. The exploitation of this issue may enable the attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For versions prior to 81.0.4044.122, update to version 81.0.4044.122 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 80.0.3987.116 **Description** The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, which could lead to unauthorized access to confidential data, denial of service, or impact data integrity. **Recommendations** For versions prior to 80.0.3987.116, update to version 80.0.3987.116 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.117 **Description** The issue is related to a use after free in the audio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to sensitive data, disruption of data integrity, and potentially cause a denial of service. **Recommendations** For versions prior to 79.0.3945.117, update to version 79.0.3945.117 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.79 **Description** The issue is related to a use-after-free in WebSockets, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to protected information and compromise its integrity and availability. **Recommendations** For versions prior to 79.0.3945.79, update to version 79.0.3945.79 or later to resolve the issue. As a temporary workaround, consider restricting access to WebSockets or avoiding the use of crafted HTML pages that could trigger the exploitation of this issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.4 macOS Mojave versions prior to 10.14.6 tvOS versions prior to 12.4 Safari versions prior to 12.1.2 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is caused by multiple memory corruption problems, which can be exploited by processing maliciously crafted web content, potentially leading to arbitrary code execution. This is due to a buffer overflow in the WebKit display module, allowing a remote attacker to execute arbitrary code. **Recommendations** For iOS versions prior to 12.4, update to iOS 12.4 or later. For macOS Mojave versions prior to 10.14.6, update to macOS Mojave 10.14.6 or later. For tvOS versions prior to 12.4, update to tvOS 12.4 or later. For Safari versions prior to 12.1.2, update to Safari 12.1.2 or later. For iTunes for Windows versions prior to 12.9.6, update to iTunes for Windows 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to iCloud for Windows 7.13 or 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 76.0.3809.132 **Description** The issue is related to a use after free in the Blink rendering engine of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page. This could potentially lead to data corruption, unauthorized access to sensitive information, and denial of service. **Recommendations** For versions prior to 76.0.3809.132, update to version 76.0.3809.132 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious web pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 72.0.3626.81 **Description** The issue is related to incorrect object lifecycle management in Blink, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, causing a denial of service. **Recommendations** For versions prior to 72.0.3626.81, update to version 72.0.3626.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 72.0.3626.81 **Description** The issue is related to insufficient checks of pointer validity in WebRTC, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to a denial of service. **Recommendations** For versions prior to 72.0.3626.81, update to version 72.0.3626.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 70.0.3538.67 **Description** The issue is related to the use of memory after it has been freed in the HTMLImportsController function of the Blink rendering engine in Google Chrome. This could allow a remote attacker to potentially exploit heap corruption by using a specially crafted HTML page. **Recommendations** For versions prior to 70.0.3538.67, update to version 70.0.3538.67 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 70.0.3538.67 **Description** A heap buffer overflow in the GPU of Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is related to a buffer overflow in the GPU engine, which could be exploited by a remote attacker using a specially crafted HTML page, potentially leading to a denial of service. **Recommendations** For versions prior to 70.0.3538.67, update to version 70.0.3538.67 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 71.0.3578.80 **Description** The issue is caused by the incorrect, thread-unsafe use of SkImage in Canvas, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to cause buffer overflow. **Recommendations** For versions prior to 71.0.3578.80, update to version 71.0.3578.80 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 69.0.3497.81 **Description** The issue is related to a use after free in the WebAudio component, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could potentially lead to a denial of service. **Recommendations** For versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 68.0.3440.75 **Description** A race condition in the Oilpan component of Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 68.0.3440.75, update to version 68.0.3440.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 8.0 **Description** A remote code execution issue in the Android media framework's libavc library is related to inadequate access control. This allows a remote attacker to execute arbitrary code. **Recommendations** For Android versions 6.0 through 8.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2 through 7.1.2 **Description** The issue is related to a remote code execution vulnerability in the Android media framework, specifically in the libhevc library. This vulnerability is associated with insufficient access control, which can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For Android versions 5.0.2 through 7.1.2, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.2 **Description** The issue is related to a remote code execution vulnerability in the Android media framework, specifically in the libstagefright library. This vulnerability is associated with inadequate access control. It allows a remote attacker to execute arbitrary code. **Recommendations** For Android versions 6.0 through 7.1.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.