Information disclosure

Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2017-15386

Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

Design/Logic Flaw

Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...

CVE-2017-5128

Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL...

CVE-2017-5133

Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file...

CVE-2017-15395

A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference...

UBUNTU-CVE-2017-15386

Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

UBUNTU-CVE-2017-15387

Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page...

CVE-2017-5129

Removed by vendor...

CVE-2017-5129

CVE-2017-5129 is a use-after-free vulnerability in the WebAudio component of the Chromium Blink stack used by Google Chrome, present in versions prior to 62.0.3202.62. A crafted HTML page can trigger a use-after-free that allows an out-of-bounds memory read. Multiple connected sources (including ...

CVE-2017-15386

The CVE-2017-15386 issue affects the Blink component in Google Chrome prior to 62.0.3202.62, where an incorrect implementation could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The connected sources corroborate that this is a UI/content spoofing vulnerability i...

CVE-2017-15395

The CVE-2017-15395 entry concerns a null-pointer dereference in the ImageCapture component of Chromium/Blink, leading to a potential denial of service or instability. Affected products include Chromium-based browsers (Chromium/Chromium-browser and Google Chrome) with versions prior to 62.0.3202.6...

CVE-2017-15387

CVE-2017-15387 affects Chromium/Blink; before 62.0.3202.62 there was insufficient enforcement of Content Security Policy, allowing a remote attacker to open javascript: URLs via a crafted HTML page. Affected software is the Chromium browser (Blink engine) prior to 62.0.3202.62. Remediation is to ...

CVE-2017-5124

Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted MHTML page...

CVE-2017-5133

Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file...

CVE-2017-5128

Removed by vendor...

CVE-2017-5124

Removed by vendor...

CVE-2017-15395

Removed by vendor...

RHEL 6 : chromium-browser (RHSA-2018:0265)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:0265 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 64.0.3282.119. Security Fixes:...

chromium-browser: same origin bypass in shared worker

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page...