CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6147 – chromium-browser: Password fields not taking advantage of OS protections in Views
https://notcve.org/view.php?id=CVE-2018-6147
07 Jun 2018 — Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process. La falta de un modo seguro de introducción de texto en Browser UI en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante local pudiese obtener información potencialmente sensible del la memoria del proceso mediante un proceso local. Chromium is an open-source web browser, powered... • http://www.securityfocus.com/bid/104309 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 3%CPEs: 5EXPL: 0CVE-2018-6120 – chromium-browser: Heap buffer overflow in PDFium
https://notcve.org/view.php?id=CVE-2018-6120
15 May 2018 — An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. Un desbordamiento de enteros que conduce a una escritura fuera de límites basada en memoria dinámica (heap) controlada por el atacante en PDFium en Google Chrome en versiones anteriores a la 66.0.3359.170 permitía que un atacante remoto ejecutase código arbitrario dentro de un sand... • http://www.securityfocus.com/bid/104143 • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6121 – chromium-browser: Privilege Escalation in extensions
https://notcve.org/view.php?id=CVE-2018-6121
15 May 2018 — Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page. La validación insuficiente de la entrada en Blink en Google Chrome antes de 66.0.3359.170 permitió a un atacante remoto realizar una escalada de privilegios a través de una página HTML diseñada. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less than 66.0... • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6122 – chromium-browser: Type confusion in V8
https://notcve.org/view.php?id=CVE-2018-6122
15 May 2018 — Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una confusión de tipo en WebAssembly en Google Chrome versiones anteriores a 66.0.3359.139, permitía a un atacante remoto explotar potencialmente la corrupción de la pila por medio de una página HTML diseñada Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less ... • https://crbug.com/836141 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6118 – chromium-browser: Use after free in Media Cache
https://notcve.org/view.php?id=CVE-2018-6118
03 May 2018 — A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. Un doble desalojo en la memoria caché en modo Incógnito que llevó a un usuario después de la memoria caché libre en Google Chrome antes de 66.0.3359.139 permitió que un atacante remoto que había comprometido el proceso del renderizador ejecutara código arbitrario a tr... • https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html • CWE-416: Use After Free •
CVSS: 9.6EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6085 – chromium-browser: Use after free in Disk Cache
https://notcve.org/view.php?id=CVE-2018-6085
24 Apr 2018 — Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. La reentrada de un destructor en Networking Disk Cache en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •
CVSS: 9.6EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6086 – chromium-browser: Use after free in Disk Cache
https://notcve.org/view.php?id=CVE-2018-6086
24 Apr 2018 — A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Una doble expulsión en la caché del modo incógnito que conducía a un uso de memoria previamente liberada en Networking Disk Cache en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada. Chro... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 6%CPEs: 6EXPL: 0CVE-2018-6087 – chromium-browser: Use after free in WebAssembly
https://notcve.org/view.php?id=CVE-2018-6087
24 Apr 2018 — A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Un uso de memoria previamente liberada en WebAssembly en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.11... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 5%CPEs: 6EXPL: 0CVE-2018-6088 – chromium-browser: Use after free in PDFium
https://notcve.org/view.php?id=CVE-2018-6088
24 Apr 2018 — An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. Un error de invalidación de iteradores en PDFium en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante un archivo PDF manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.11... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6089 – chromium-browser: Same origin policy bypass in Service Worker
https://notcve.org/view.php?id=CVE-2018-6089
24 Apr 2018 — A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. La falta de comprobación de CORS tras una redirección de un Service Worker a un PDF cross-origin en Service Worker en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto filtrase datos cross-origin limitados mediante una página HTML manipulada. Chrom... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •