CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 0CVE-2016-5136 – chromium-browser: use after free in extensions
https://notcve.org/view.php?id=CVE-2016-5136
23 Jul 2016 — Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion. Vulnerabilidad de uso después de liberación de memoria en extensions/renderer/user_script_injector.cc en el subsistema Extensions en Google Chrome en versiones anteriores a 52.0.2743.82 permite a atacantes remotos provocar una denegació... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5133 – chromium-browser: origin confusion in proxy authentication
https://notcve.org/view.php?id=CVE-2016-5133
23 Jul 2016 — Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. Google Chrome en versiones anteriores a 52.0.2743.82 no maneja correctamente información de origen durante la autenticación del proxy, lo que permite a atacantes man-in-the-middle suplantar una autenticación del proxy de aviso de inicio de sesión o ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1708 – chromium-browser: use-after-free in extensions
https://notcve.org/view.php?id=CVE-2016-1708
23 Jul 2016 — The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site. La implementación de la instalación en línea Chrome Web Store en el subsistema Extensions en Google Chrome en versiones anteriores a 52.0.2743.82 no considera adecuadamente la ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-5128 – chromium-browser: same-origin bypass in v8
https://notcve.org/view.php?id=CVE-2016-5128
23 Jul 2016 — objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. objects.cc en Google V8 en versiones anteriores a 5.2.361.27, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, no impide que los interceptores de la API modifiquen un objetivo de almacenamiento sin ajustar una propiedad,... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5132 – chromium-browser: limited same-origin bypass in service workers
https://notcve.org/view.php?id=CVE-2016-5132
23 Jul 2016 — The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element. El subsistema Service Workers en Google Chrome en versiones anteriores a 52.0.2743.82 no implementa adecuadamente la especificación Secure Contexts durante las decisiones sobre si se debe controlar un submar... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 10%CPEs: 17EXPL: 0CVE-2016-5131 – libxml2: Use after free triggered by XPointer paths beginning with range-to
https://notcve.org/view.php?id=CVE-2016-5131
23 Jul 2016 — Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Vulnerabilidad de uso después de liberación de memoria en libxml2 hasta la versión 2.9.4, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-1709 – chromium-browser: heap-buffer-overflow in sfntly
https://notcve.org/view.php?id=CVE-2016-1709
23 Jul 2016 — Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font. Desbordamiento de buffer basado en memoria dinámica en el método ByteArray::Get en data/byte_array.cc en Google sfntly en versiones anteriores a 2016-06-10, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, pe... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5134 – chromium-browser: url leakage via pac script
https://notcve.org/view.php?id=CVE-2016-5134
23 Jul 2016 — net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763. net/proxy/proxy_service.cc en la funcionalidad Proxy Auto-Config (PAC) en Google Chrome en versiones anteriores a 52.0.2743.82 no asegura que la información de URL está restringida a un esquema, host ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1710 – chromium-browser: same-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1710
23 Jul 2016 — The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. El método ChromeClientImpl::createWindow en WebKit/Source/web/ChromeClientImpl.cpp en Blink, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, no previene la creación de la ventana por un marco diferido, lo q... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1707
https://notcve.org/view.php?id=CVE-2016-1707
23 Jul 2016 — ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site. ios/web/web_state/ui/crw_web_controller.mm en Google Chrome en versiones anteriores en 52.0.2743.82 en iOS no asegura que una URL no válida sea reemplazada con la URL about:blank, lo que permite a atacantes remotos suplantar la URL mostrada a través de un sitio web manipu... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-20: Improper Input Validation •