CVE-2018-18340
Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published Updated
PatchFirst · Latest vulnerabilities
chromium-browser vulnerabilities · Page 37
Vulnerabilities published for chromium-browser in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 1138
CVE-2018-18339
Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-18338
Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-18337
Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-18336
Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-18335
Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-17481
Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-17480
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Update to 71.0.3578.80-0ubuntu0.16.04.1
Published UpdatedCVE-2018-6152
The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.
- Update to 68.0.3440.75-0ubuntu0.16.04.1
Published UpdatedCVE-2018-6116
A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6115
Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6108
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6107
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6105
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6104
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6103
A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6102
Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6101
A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6099
A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published UpdatedCVE-2018-6098
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- Update to 66.0.3359.139-0ubuntu0.16.04.3
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.