UBUNTU-CVE-2021-21156

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted script...

USN-4739-1: WebKitGTK vulnerability

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

UBUNTU-CVE-2021-21148

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2021-21118

Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

serenity:FuzzJs: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>JS::GlobalObject::gc in AK::Function<JS::Value

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5748059638202368 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffdd2626ae8 Crash Stat...

Google Chrome Zero-Day Afflicts Windows, Mac Users

Google is warning of a zero-day vulnerability in its V8 open-source web engine that’s being actively exploited by attackers. A patch has been issued in version 88 of Google’s Chrome browser — specifically, version 88.0.4324.150 for Windows, Mac and Linux. This update will roll out over the coming...

Google Chrome Buffer Error Vulnerability

Google Chrome is a web browser from Google, Inc USA. Google Chrome suffers from a buffer error vulnerability that can be exploited by an attacker who can trigger a buffer overflow via Chrome's V8, which triggers a denial of service and may run code...

PT-2021-2066

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 88.0.4324.150 Description: A heap buffer overflow in the V8 JavaScript engine allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue was actively exploited in the...

Facebook Hermes Buffer Error Vulnerability

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native apps, going to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes suffers from a buffe...

CVE-2021-23962

Incorrect use of the '' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox 85...

CVE-2021-23961

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...

CVE-2021-23955

The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox 85...

CVE-2021-23965

Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 85...

Google Chrome buffer error vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A data validation insufficiency vulnerability exists in V8 in versions prior to Google Chrome 88.0.4324.96. An attacker can exploit this to perform out-of-range...

In-the-Wild Series: Chrome Infinity Bug

This is part 2 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post. Posted by Sergei Glazunov, Project Zero This post only covers one of the exploits, specifically a renderer...

browser_pwn

This repository is an offensive tool for browser exploitation. It contains a proof-of-concept PoC exploit for a vulnerability in the V8 JavaScript engine, which is used by Google Chrome and other browsers. The exploit targets a vulnerability in the V8 engine that allows for type confusion attacks...

UBUNTU-CVE-2020-16013

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

serenity:FuzzJs: Bad-cast to JS::GlobalObject from JS::Object in JS::Object::Object

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5369591899488256 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000003304030 Crash Stat...

CVE-2020-13547

A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the user to...

CVE-2020-13547

A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigger an improper use of an object, resulting in memory corruption and arbitrary code execution. An attacker needs to trick the user to...