CVE-2015-1224

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 41.0.2272.76

Description The issue arises from the VpxVideoDecoder::VpxDecode function in the vpxdecoder implementation, where it fails to ensure that alpha-plane dimensions match image dimensions. This allows remote attackers to cause a denial of service (out-of-bounds read) by providing crafted VPx video data.

Recommendations For versions prior to 41.0.2272.76, update to version 41.0.2272.76 or later to resolve the issue. As a temporary workaround, consider restricting the use of the VpxVideoDecoder::VpxDecode function until a patch is applied.