CVE-2016-5224

CVE-2016-5224 affects Chromium/Blink SVG handling. The Debian advisory and related feeds describe a same-origin policy bypass in the SVG component of the Chromium browser, with historical references to a timing-attack-derived bypass in denormalized floating-point SVG filters (Chrome prior to 55.0...

CVE-2016-5207

In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page...

CVE-2016-5209

The CVE-2016-5209 issue affects Blink in Google Chrome on desktop (Mac/Windows/Linux) and Android where a bad casting in bitmap manipulation could trigger a heap-write/heap-corruption through a crafted HTML page. Root cause: an out-of-bounds write in Blink/WebKit as described for this CVE. Impact...

CVE-2016-9650

Removed by vendor...

CVE-2016-5225

Removed by vendor...

CVE-2016-5208

Removed by vendor...

CVE-2016-5205

Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5208

CVE-2016-5208 is a UXSS cross-site scripting flaw in Blink for Google Chrome prior to 55.0.2883.75 on Linux/Windows and 55.0.2883.84 on Android, allowing remote script/HTML injection via crafted HTML during synchronous event handling. Desktop remediation: upgrade to Chrome 55.0.2883.75+ (and Chro...

CVE-2016-5224

A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...

CVE-2016-5204

CVE-2016-5204 affects Chromium-based browsers (Blink SVG image handling). The issue is a cross-site scripting (UXSS) vulnerability caused by SVG shadow DOM handling that can allow script/HTML injection via crafted pages. Desktop/chromium versions prior to 55.0.2883.75 (desktop) and 55.0.2883.84 (...

CVE-2016-5207

Removed by vendor...

CVE-2016-5209

Removed by vendor...

KLA10949 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome prior to 55.0.2883.75. Malicious users can exploit these vulnerabilities to bypass security restrictions, make code injections and possibly cause denial of service, obtain sensitive information. Below is a complete list of...

Legacy Opera Presto source code appearance in online sharing sites

Security Legacy Opera Presto source code appearance in online sharing sites Share January 18th, 2017 Opera recently became aware that source code from our legacy browser engine, Presto, has appeared in some online code and file sharing sites. This code is the property of Opera Software and has be...

Google Chrome Blink ImageBitmap Integer Overflow (CVE-2016-5182)

A heap overflow vulnerability exists in Google Chrome Blink. The vulnerability is due to an integer overflow in a function while processing an HTML file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted HTML file, potentially leading...

CVE-2016-5188

Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages...

CVE-2016-5182

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages...

Cross site scripting

Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages...

Design/Logic Flaw

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages...

CVE-2016-5181

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via crafted HTML pages...