CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13682 – chromium-browser: Site isolation bypass
https://notcve.org/view.php?id=CVE-2019-13682
Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Una aplicación de política insuficiente en external protocol handling en Google Chrome versiones anteriores a 77.0.3865.75, permitió a un atacante remoto omitir la política del mismo origen por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html https://crbug.com/971917 https://access.redhat.com/security/cve/CVE-2019-13682 https://bugzilla.redhat.com/show_bug.cgi?id=1762402 • CWE-281: Improper Preservation of Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13686 – chromium-browser: Use-after-free in offline pages
https://notcve.org/view.php?id=CVE-2019-13686
Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en offline en Google Chrome versiones anteriores a 77.0.3865.90, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop_18.html https://crbug.com/1000002 https://access.redhat.com/security/cve/CVE-2019-13686 https://bugzilla.redhat.com/show_bug.cgi?id=1762476 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13688 – chromium-browser: Use-after-free in media
https://notcve.org/view.php?id=CVE-2019-13688
Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en Blink en Google Chrome versiones anteriores a 77.0.3865.90, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop_18.html https://crbug.com/995964 https://access.redhat.com/security/cve/CVE-2019-13688 https://bugzilla.redhat.com/show_bug.cgi?id=1762474 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13691 – chromium-browser: Omnibox spoof
https://notcve.org/view.php?id=CVE-2019-13691
Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. La comprobación insuficiente de una entrada no confiable en navigation en Google Chrome versiones anteriores a 77.0.3865.75, permitió a un atacante remoto falsificar el contenido del Omnibox (barra de URL) por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html https://crbug.com/966914 https://access.redhat.com/security/cve/CVE-2019-13691 https://bugzilla.redhat.com/show_bug.cgi?id=1762372 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13698 – Google Chromium RegExpReplace Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-13698
Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un acceso a la memoria fuera de límites en JavaScript en Google Chrome versiones anteriores a 73.0.3683.103, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Google Chromium. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the JavaScript RegExp.replace method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. • https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop.html https://crbug.com/944971 • CWE-787: Out-of-bounds Write •