Priority LOW 23
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML pag…
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.01602 · Published 2017-04-24 · Fixed
Priority LOW 30
XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01453 · Published 2017-04-24 · Fixed CWE-79
Priority LOW 33
Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a c…
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.02587 · Published 2017-04-24 · Fixed CWE-787
Priority LOW 26
Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connecti…
CVSS 3.1MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.00426 · Published 2017-04-24 · Fixed CWE-311
Priority MEDIUM 42
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.27434 · Published 2017-04-24 · Fixed
Priority LOW 37
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0124 · Published 2017-04-24 · Fixed CWE-416
Priority LOW 36
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file,…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01209 · Published 2017-04-24 · Fixed CWE-190
Priority LOW 36
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01176 · Published 2017-04-24 · Fixed CWE-416
Priority LOW 24
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass conte…
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.01747 · Published 2017-04-24 · Fixed CWE-281
Priority MEDIUM 43
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow duri…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02528 · Published 2017-04-24 · Fixed in 1.7.2 CWE-787