Vulnerabilities > Google > Chrome > 37.0.2062.3

DATE CVE VULNERABILITY TITLE RISK
2016-02-21 CVE-2016-1628 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.
network
low complexity
google debian CWE-119
6.3
2016-02-14 CVE-2016-1627 Permissions, Privileges, and Access Controls vulnerability in multiple products
The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js.
network
low complexity
opensuse debian google CWE-264
8.8
2016-02-14 CVE-2016-1625 Permissions, Privileges, and Access Controls vulnerability in multiple products
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instant_service.cc and search_tab_helper.cc.
network
low complexity
opensuse google debian CWE-264
4.3
2016-02-14 CVE-2016-1624 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.
network
low complexity
opensuse google debian CWE-119
8.8
2016-02-14 CVE-2016-1623 Permissions, Privileges, and Access Controls vulnerability in multiple products
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp.
network
low complexity
debian google opensuse CWE-264
8.8
2016-02-14 CVE-2016-1622 Permissions, Privileges, and Access Controls vulnerability in multiple products
The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
network
low complexity
google debian opensuse CWE-264
8.8
2016-01-25 CVE-2016-2052 Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
network
low complexity
harfbuzz-project google
7.6
2016-01-25 CVE-2016-2051 Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
network
low complexity
google redhat
critical
9.8
2016-01-25 CVE-2016-1620 Unspecified vulnerability in Google Chrome
Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
network
low complexity
google
8.8
2016-01-25 CVE-2016-1619 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Google Chrome
Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
network
low complexity
google CWE-119
7.6