Asnine

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in LocalNetworkAccess within Google Chrome. A crafted HTML page could allow a remote attacker to bypass navigation restrictions. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 134.0.6998.35 **Description** The issue allows a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. This is due to an out of bounds read in PDFium in Google Chrome. The severity of this issue is classified as medium by Chromium. **Recommendations** For Google Chrome versions prior to 134.0.6998.35, update to version 134.0.6998.35 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted PDF files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 133.0.6943.98 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free vulnerability in the Navigation function of Google Chrome and Microsoft Edge browsers. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension, potentially leading to remote code execution or denial of service. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 133.0.6943.98, update to version 133.0.6943.98 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 139.0.7258.66 **Description** A use-after-free issue existed in the Extensions component of Google Chrome. This allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. The security severity is rated as Medium. **Recommendations** Update Google Chrome to version 139.0.7258.66 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in Microsoft Edge, which is based on Chromium. This vulnerability can be exploited by a remote attacker to elevate their privileges. The vulnerability is associated with access control errors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 116.0.5845.96 **Description** The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. The severity of this issue is classified as Medium by Chromium security. **Recommendations** For versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of extensions from untrusted sources and restricting the use of extensions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 114.0.5735.133 **Description** The issue is related to a use after free in WebRTC, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. **Recommendations** For versions prior to 114.0.5735.133, update to version 114.0.5735.133 or later to resolve the issue. As a temporary workaround, consider restricting access to WebRTC functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 113.0.5672.126 **Description** The issue is related to a use after free in DevTools, allowing a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The attacker can use a specially crafted HTML page to exploit this issue. **Recommendations** For versions prior to 113.0.5672.126, update to version 113.0.5672.126 or later to resolve the issue. As a temporary workaround, consider restricting access to the DevTools feature until a patch is applied. Avoid using DevTools with untrusted HTML pages until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 114.0.5735.90 **Description** The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. This could potentially lead to access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For versions prior to 114.0.5735.90, update to version 114.0.5735.90 or later to resolve the issue. As a temporary workaround, consider disabling the installation of new extensions until the update is applied. Restrict access to crafted HTML pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 113.0.5672.126 **Description** The issue is related to the use of memory after it has been freed in the Guest View mode of Google Chrome and Microsoft Edge browsers. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by using a specially crafted HTML page. An attacker who convinces a user to install a malicious extension could potentially exploit heap corruption. **Recommendations** For Google Chrome versions prior to 113.0.5672.126, update to version 113.0.5672.126 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of malicious extensions and restricting access to untrusted HTML pages.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 109.0.5414.74 **Description** The issue is related to a heap buffer overflow in the Network Service of Google Chrome, which could be exploited by an attacker who convinces a user to install a malicious extension. This exploitation could potentially lead to heap corruption via a crafted HTML page and specific interactions. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 109.0.5414.74, update to version 109.0.5414.74 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions until the update is applied. Restrict access to crafted HTML pages to minimize the risk of exploitation. Avoid interactions that could trigger the heap buffer overflow in the Network Service.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 104.0.5112.79 Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient validation of untrusted input, which can be exploited by a remote attacker to bypass download restrictions via a malicious file. This could potentially allow the attacker to disclose protected information. **Recommendations** For Google Chrome versions prior to 104.0.5112.79, update to version 104.0.5112.79 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 90.0.4430.72 **Description** The issue is related to a use after free in Blink, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page. This may impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge versions 10.0.14393.0 through 10.0.15063.0 Microsoft Edge in Windows 10 1607, 1703, and Windows Server 2016 **Description** A remote code execution issue exists due to the way Microsoft scripting engines handle objects in memory, potentially allowing an attacker to execute arbitrary code in the context of the current user. This could be achieved by corrupting memory, and if the current user has administrative rights, an attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Edge in Windows 10 1607, update to a version that fixes the memory corruption issue. For Microsoft Edge in Windows 10 1703, apply the necessary patch to resolve the scripting engine vulnerability. For Microsoft Edge in Windows Server 2016, ensure that all security updates are applied to prevent exploitation of the vulnerability. As a temporary workaround, consider restricting access to sensitive data and limiting user privileges to minimize the risk of exploitation until a patch is available.