chromium-browser: universal xss in blink

Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

Google Chrome PDFium File Download Bypass Vulnerability

Google Chrome is the United States Google Google company developed a Web browser. PDFium is one of the open source PDF rendering engine. A security vulnerability exists in PDFium in versions of Google Chrome prior to 55.0.2883.75. An attacker can exploit this vulnerability to obtain sensitive...

UBUNTU-CVE-2016-9073

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox 50...

Mozilla Firefox Timing Attack Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A timing attack vulnerability exists in the Canvas filter in versions of Mozilla Firefox prior to 50. An attacker can exploit this vulnerability to conduct timing attacks...

Mozilla Firefox elevation of privilege vulnerability (CNVD-2016-11412)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A privilege extraction vulnerability exists in the Mozilla Maintenance Service in versions of Mozilla Firefox prior to 50 on Windows-based platforms. An attacker can exploit this vulnerability ...

Mozilla Firefox Memory Misreference Vulnerability (CNVD-2016-11417)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A memory misreference vulnerability exists in the 'nsINode::ReplaceOrInsertBefore' function in versions of Mozilla Firefox prior to 50. An attacker could exploit this vulnerability to cause a...

Mozilla Firefox Memory Misreference Vulnerability (CNVD-2016-11415)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A memory misreference vulnerability exists in the 'nsINode::ReplaceOrInsertBefore' function in versions of Mozilla Firefox prior to 50. An attacker could exploit this vulnerability to cause a...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2016-11418)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A denial of service vulnerability exists in versions of Mozilla Firefox prior to 50. An attacker can exploit this vulnerability to cause a denial of service crash with a malicious URL...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2016-11416)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A denial of service vulnerability exists in the 'nsRefreshDriver' function in versions of Mozilla Firefox prior to 50. An attacker can exploit this vulnerability to cause a denial of service...

UBUNTU-CVE-2016-9068

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9076

An issue where a "" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9063

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9070

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9069

A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-9067

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox 50...

UBUNTU-CVE-2016-5292

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox 50...

CVE-2016-8291

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Application Platform...

CVE-2016-5529

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5530 and CVE-2016-8293...

chromium-browser: scheme bypass

Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages...

chromium-browser: cross-origin bypass in blink

Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages...