CVE-2010-0649

Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in
sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows
attackers to leverage renderer access to cause a denial of service (heap
memory corruption) or possibly have unspecified other impact via a
malformed message, related to deserializing of sandbox messages.

Bugs

• <http://code.google.com/p/chromium/issues/detail?id=32915&gt;