CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6121 – chromium-browser: Privilege Escalation in extensions
https://notcve.org/view.php?id=CVE-2018-6121
15 May 2018 — Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page. La validación insuficiente de la entrada en Blink en Google Chrome antes de 66.0.3359.170 permitió a un atacante remoto realizar una escalada de privilegios a través de una página HTML diseñada. Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less than 66.0... • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6118 – chromium-browser: Use after free in Media Cache
https://notcve.org/view.php?id=CVE-2018-6118
03 May 2018 — A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. Un doble desalojo en la memoria caché en modo Incógnito que llevó a un usuario después de la memoria caché libre en Google Chrome antes de 66.0.3359.139 permitió que un atacante remoto que había comprometido el proceso del renderizador ejecutara código arbitrario a tr... • https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6089 – chromium-browser: Same origin policy bypass in Service Worker
https://notcve.org/view.php?id=CVE-2018-6089
24 Apr 2018 — A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. La falta de comprobación de CORS tras una redirección de un Service Worker a un PDF cross-origin en Service Worker en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto filtrase datos cross-origin limitados mediante una página HTML manipulada. Chrom... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6101 – chromium-browser: Insufficient protection of remote debugging prototol in DevTools
https://notcve.org/view.php?id=CVE-2018-6101
24 Apr 2018 — A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server. La falta de validación del host en DevTools en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada si el usuario está ejecutando un servidor de depuración DevTools remoto. Chromium is an open-sou... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6114 – chromium-browser: CSP bypass
https://notcve.org/view.php?id=CVE-2018-6114
24 Apr 2018 — Incorrect enforcement of CSP for
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6110 – chromium-browser: Incorrect handling of plaintext files via file://
https://notcve.org/view.php?id=CVE-2018-6110
24 Apr 2018 — Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page. El análisis de documentos como HTML en Downloads en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto provocase que Chrome ejecutase scripts mediante una página local que no fuese HTML. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Iss... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 5%CPEs: 6EXPL: 0CVE-2018-6088 – chromium-browser: Use after free in PDFium
https://notcve.org/view.php?id=CVE-2018-6088
24 Apr 2018 — An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. Un error de invalidación de iteradores en PDFium en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante un archivo PDF manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.11... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6086 – chromium-browser: Use after free in Disk Cache
https://notcve.org/view.php?id=CVE-2018-6086
24 Apr 2018 — A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Una doble expulsión en la caché del modo incógnito que conducía a un uso de memoria previamente liberada en Networking Disk Cache en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada. Chro... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6103 – chromium-browser: UI spoof in Permissions
https://notcve.org/view.php?id=CVE-2018-6103
24 Apr 2018 — A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. Un mensaje de permisos estancado en Prompts en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto omitiese las políticas de permisos mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buf... • http://www.securityfocus.com/bid/103917 •
CVSS: 8.8EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6090 – chromium-browser: Heap buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6090
24 Apr 2018 — An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Un desbordamiento de enteros que conduce a un desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Chromium is an open-so... • http://www.securityfocus.com/bid/103917 • CWE-190: Integer Overflow or Wraparound •