CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2845 – chromium-browser: CSP implementation in Blink does not ignore a URL's path component in the case of a ServiceWorker fetch
https://notcve.org/view.php?id=CVE-2016-2845
06 Mar 2016 — The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation reports, related to FrameFetchContext.cpp and ResourceFetcher.cpp. La implementación de la Content Security Policy (CSP) en Blink, tal como se utiliza en Google Chrome en versiones anteriores a 49.0.2623.75, no ignora u... • http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2016-1629 – chromium-browser: same-origin bypass in Blink and Sandbox escape in Chrome
https://notcve.org/view.php?id=CVE-2016-1629
21 Feb 2016 — Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors. Google Chrome en versiones anteriores a 48.0.2564.116 permite a atacantes remotos eludir la Blink Same Origin Policy y el mecanismo de protección sandbox a través de vectores no especificados. Chromium is an open-source web browser, powered by WebKit. Two flaws were found in the processing of malformed web content. A web page containing malicious conte... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_18.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 25%CPEs: 2EXPL: 0CVE-2016-1628 – Google Chrome Pdfium JPEG2000 Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1628
18 Feb 2016 — pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions. pi.c en OpenJPEG, como se utiliza en PDFium en Google Chrome en versiones anteriores a 48.0.2564.109, no valida cierto valor precision, lo que permite a a... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2016-1622 – chromium-browser: same-origin bypass in Extensions
https://notcve.org/view.php?id=CVE-2016-1622
14 Feb 2016 — The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. El subsistema Extensions en Google Chrome en versiones anteriores a 48.0.2564.109 no previene el uso del método Object.defineProperty para sobreescribir el comportamiento de extensión previsto, lo que permite a atacantes remotos eludir la Same Origin Policy a... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1623 – chromium-browser: same-origin bypass in DOM
https://notcve.org/view.php?id=CVE-2016-1623
14 Feb 2016 — The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp. La implementación DOM en Google Chrome en versiones anteriores a 48.0.2564.109 no restringe adecuadamente que las operaciones frame-attach ocurran durante o desp... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 0CVE-2016-1624 – chromium-browser: buffer overflow in Brotli
https://notcve.org/view.php?id=CVE-2016-1624
14 Feb 2016 — Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression. Desbordamiento inferior de entero en la función ProcessCommandsInternal en dec/decode.c en Brotli, como se utiliza en Google Chrome en versiones anteriores a 48.0.2564.109, permite a atacantes remotos causar una denegación de... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1625 – chromium-browser: navigation bypass in Chrome Instant
https://notcve.org/view.php?id=CVE-2016-1625
14 Feb 2016 — The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instant_service.cc and search_tab_helper.cc. La funcionalidad Chrome Instant en Google Chrome en versiones anteriores a 48.0.2564.109 no asegura que un destino de navegación New Tab Page (NTP) se encuentre en las listas de más visitados o sugere... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1627 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1627
14 Feb 2016 — The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js. El subsistema Developer Tools (también conocido como DevTools) en Google Chrome en versiones anteriores a ... • http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.6EPSS: 7%CPEs: 1EXPL: 0CVE-2016-1612 – chromium-browser: bad cast in V8
https://notcve.org/view.php?id=CVE-2016-1612
25 Jan 2016 — The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code. La función LoadIC::UpdateCaches en ic/ic.cc en Google V8, tal como se utiliza en Google Chrome en versiones anteriores a 48.0.2564.82, no asegura la compatibilidad del receptor antes de re... • http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html • CWE-20: Improper Input Validation CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.6EPSS: 2%CPEs: 1EXPL: 0CVE-2016-1613 – chromium-browser: use-after-free in PDFium
https://notcve.org/view.php?id=CVE-2016-1613
25 Jan 2016 — Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects. Múltiples vulnerabilidades de uso después de liberación de memoria en la implementación de formfiller en PDFium, tal como se utiliza en Google Chrome en ver... • http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html • CWE-416: Use After Free •