Google Chrome vulnerabilities

CVE-2016-1633 [CRITICAL] CVE-2016-1633: Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote a Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2016-2843 [CRITICAL] CVE-2016-2843: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2016-1636 [CRITICAL] CWE-264 CVE-2016-1636: The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chr The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads

CVE-2016-1639 [CRITICAL] CVE-2016-1639: Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect reliance on the resource context pointer.

CVE-2016-1641 [HIGH] CVE-2016-1641: Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome b Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.

CVE-2016-2844 [HIGH] CWE-20 CVE-2016-2844: WebKit/Source/core/layout/LayoutBlock.cpp in Blink, as used in Google Chrome before 49.0.2623.75, do WebKit/Source/core/layout/LayoutBlock.cpp in Blink, as used in Google Chrome before 49.0.2623.75, does not properly determine when anonymous block wrappers may exist, which allows remote attackers to cause a denial of service (incorrect cast and assertion failure) or possibly have unspecified other impact via crafted JavaScript code.

CVE-2016-1632 [HIGH] CWE-264 CVE-2016-1632: The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own propert The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.

CVE-2016-1631 [HIGH] CWE-264 CVE-2016-1631: The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_lo The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CVE-2016-1630 [HIGH] CWE-264 CVE-2016-1630: The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site.

CVE-2016-1634 [HIGH] CVE-2016-1634: Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/cor Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/core/css/resolver/StyleResolver.cpp in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that triggers Cascading Style Sheets (CSS) style invalid

CVE-2016-2845 [MEDIUM] CWE-200 CVE-2016-2845: The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623 The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation reports, related to FrameFetchContext.cpp and ResourceFetche

CVE-2016-1637 [MEDIUM] CWE-200 CVE-2016-1637: The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome before 49.0.2623.75, mishandles arctangent calculations, which allows remote attackers to obtain sensitive information via a crafted web site.

CVE-2016-1640 [MEDIUM] CWE-17 CVE-2016-1640: The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623 The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623.75 does not block installations upon deletion of an installation frame, which makes it easier for remote attackers to trick a user into believing that an installation request originated from the user's next navigation target via a crafted web site.

CVE-2016-1638 [MEDIUM] CWE-284 CVE-2016-1638: extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49 extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app.

CVE-2016-1629 [CRITICAL] CWE-264 CVE-2016-1629: Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy an Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.

CVE-2016-1628 [MEDIUM] CWE-119 CVE-2016-1628: pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certa pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functi

CVE-2016-1624 [HIGH] CWE-119 CVE-2016-1624: Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Goog Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.

CVE-2016-1623 [HIGH] CWE-264 CVE-2016-1623: The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp.

CVE-2016-1627 [HIGH] CWE-264 CVE-2016-1627: The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.c

CVE-2016-1622 [HIGH] CWE-264 CVE-2016-1622: The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.de The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.