Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
