Threat database

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. (Chromium security severity: Low)

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2023-6112 is a use-after-free vulnerability in the Navigation component of Google Chrome versions prior to 119.0.6045.159. This flaw could allow a remote attacker to cause heap corruption by crafting a malicious HTML page. The vulnerability is rated with high severity by Chromium security.

CVE-2023-5997 is a use-after-free vulnerability in the garbage collection mechanism of Google Chrome versions prior to 119.0.6045.159. This flaw allows a remote attacker to trigger heap corruption by crafting a malicious HTML page, potentially leading to arbitrary code execution or browser compromise. Exploitation does not require user authentication but does require user interaction to visit a malicious webpage. No known exploits are currently in the wild. The vulnerability affects a widely used browser, making it a significant risk for European organizations relying on Chrome for web access. Timely patching is critical to prevent exploitation. The severity is assessed as high due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation via web content.

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2136 is a critical integer overflow vulnerability in the Skia graphics library used by Google Chrome versions prior to 112.0.5615.137. This flaw allows a remote attacker who has already compromised the renderer process to potentially escape the browser's sandbox by crafting a malicious HTML page. The vulnerability impacts confidentiality, integrity, and availability with a high CVSS score of 9.6, indicating critical severity. Exploitation requires user interaction but no prior privileges or authentication. Although no known exploits are currently reported in the wild, the risk of sandbox escape makes this a significant threat. European organizations using vulnerable Chrome versions are at risk, especially those with high exposure to web-based threats.