CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38005 – Chrome ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread Heap Use-After-Free
https://notcve.org/view.php?id=CVE-2021-38005
Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de memoria previamente liberada en loader en Google Chrome versiones anteriores a 96.0.4664.45, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada Chrome suffers from a heap use-after-free vulnerability in ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread. • https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html https://crbug.com/1241091 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 https://www.debian.org/security/2022/dsa-5046 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38006 – Chrome blink::NativeIOFile::DoRead Heap Use-After-Free
https://notcve.org/view.php?id=CVE-2021-38006
Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de memoria previamente liberada en storage foundation en Google Chrome versiones anteriores a 96.0.4664.45, permitía a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada Chrome suffers from a heap use-after-free vulnerability in blink::NativeIOFile::DoRead. • https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html https://crbug.com/1240593 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 https://www.debian.org/security/2022/dsa-5046 • CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38004
https://notcve.org/view.php?id=CVE-2021-38004
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Una aplicación insuficiente de políticas en Autofill en Google Chrome versiones anteriores a 95.0.4638.69, permitía a un atacante remoto filtrar datos de origen cruzado por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html https://crbug.com/1227170 https://www.debian.org/security/2022/dsa-5046 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 2%CPEs: 4EXPL: 1CVE-2021-38003 – Google Chromium V8 Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2021-38003
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una implementación inapropiada de V8 en Google Chrome versiones anteriores a 95.0.4638.69, permitía a un atacante remoto explotar potencialmente la corrupción de la pila por medio de una página HTML diseñada Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. • https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html https://crbug.com/1263462 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 https://www.debian.org/security/2022/dsa-5046 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.6EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38002
https://notcve.org/view.php?id=CVE-2021-38002
Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Un uso de memoria previamente liberada en Web Transport en Google Chrome versiones anteriores a 95.0.4638.69, permitía a un atacante remoto llevar a cabo un escape de sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html https://crbug.com/1260940 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 https://www.debian.org/security/2022/dsa-5046 • CWE-416: Use After Free •