CVE-2023-2312

CVE-2023-2312 is a Use-after-free in Chrome/Chromium’s Offline component affecting Google Chrome (and Chromium-based browsers) on Android, prior to version 116.0.5845.96. The issue could allow a remote attacker who has already compromised the renderer process to trigger heap corruption via a craf...

CVE-2023-2312

Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-2312

Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-2312

Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, an American company. A buffer overflow vulnerability exists in versions of Google Chrome prior to 116.0.5845.96, which stems from a boundary error in Skia when handling untrusted input, and can be exploited by a remote attacker to corrupt the renderer...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in Google Chrome prior to version 116.0.5845.96, which stems from a heap buffer overflow in the Mojom IDL, which allows remote attackers to exploit heap corruption to gain control of the WebUI...

CVE-2023-4354: Out-of-bounds Write

Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-2312: Use After Free

Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-4362: Out-of-bounds Write

Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

PT-2023-4481 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.96 Description: The issue is related to a heap buffer overflow in the Mojom IDL component of Google Chrome, which could allow a remote attacker who has compromised the renderer process and gained...

GHSA-7H45-GRC5-89WQ Svelecte item names vulnerable to execution of arbitrary JavaScript

Summary Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened. Details Item names given to Svelecte appear to be directly...

Svelecte item names vulnerable to execution of arbitrary JavaScript

Summary Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened. Details Item names given to Svelecte appear to be directly...

CVE-2023-38687

Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is...

CVE-2023-38687

Svelecte (Svelte) is vulnerable to XSS because item names are rendered as raw HTML without escaping, allowing arbitrary HTML/JavaScript execution when a dropdown is opened. The default item renderer and the commonly used custom item renderer are both affected. Impact depends on trustedness of ite...

Malicious code in ynf-core-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae9c4689822e565732fd6f340eb682a5cd4ba730baa41c8a9ae891fb32d55d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1466 Malicious code in ynf-core-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae9c4689822e565732fd6f340eb682a5cd4ba730baa41c8a9ae891fb32d55d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ynf-core-renderer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-38687: Improper Neutralization of Input During Web Page Generation

Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is...

Arbitrary Code Execution

chromium is vulnerable to Arbitrary Code Execution. Inappropriate implementations in the library may allow a remote attacker who had compromised the renderer process to perform arbitrary read/write operations via a malicious file...

Spoofing Attack

chromium is vulnerable to Spoofing Attack. The vulnerability exists because the inappropriate implementation in the Picture In Picture of the library, allowing an attacker to spoof the contents of the Omnibox URL bar via a maliciously crafted HTML page through the renderer process...