Cassidy Kim

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 148.0.7778.168 **Description** A heap buffer overflow in SwiftShader allows a remote attacker to perform an out-of-bounds memory read by using a crafted HTML page. A heap buffer overflow occurs when a program writes more data to a heap-allocated memory block than it can hold, potentially allowing access to adjacent memory locations. **Recommendations** Update to version 148.0.7778.168 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 128.0.6613.119 **Description** The issue is related to a use after free flaw in the WebAudio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 128.0.6613.119, update to version 128.0.6613.119 or later to resolve the issue. As a temporary workaround, consider avoiding the use of WebAudio in Google Chrome until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 126.0.6478.54 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free vulnerability in the V8 JavaScript engine, which can lead to heap corruption. This can be exploited by a remote attacker using a specially crafted HTML page, potentially allowing them to disclose protected information. **Recommendations** For Google Chrome versions prior to 126.0.6478.54, update to version 126.0.6478.54 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 125.0.6422.141 Microsoft Edge (affected versions not specified) Description: The issue is related to a use after free vulnerability in the Media Session API implementation. This could allow a remote attacker to execute arbitrary code by loading a specially crafted HTML page. The estimated number of potentially affected devices is not specified. Recommendations: For Google Chrome versions prior to 125.0.6422.141, update to version 125.0.6422.141 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A use-after-free issue existed in the Navigation component of Google Chrome. This allowed a remote attacker to potentially execute arbitrary code within a sandbox environment by using a specially crafted HTML page. The Chromium security severity is rated as Medium. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 122.0.6261.57 Description: The issue is related to a use after free in DevTools, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could enable the attacker to execute arbitrary code. The severity of this issue is considered medium. Recommendations: For versions prior to 122.0.6261.57, update to version 122.0.6261.57 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 121.0.6167.139 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free vulnerability in the Peer Connection component of Google Chrome and Microsoft Edge browsers, which could allow a remote attacker to potentially exploit stack corruption via a crafted HTML page. This could lead to arbitrary code execution. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 121.0.6167.139, update to version 121.0.6167.139 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 122.0.6261.57 **Description** The issue is related to a use after free vulnerability in the Mojo library of Google Chrome, which can lead to heap corruption. This can potentially allow a remote attacker to execute arbitrary code by exploiting the vulnerability via a crafted HTML page. **Recommendations** For versions prior to 122.0.6261.57, update to version 122.0.6261.57 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.62 **Description** The issue is related to a use after free in the Media Stream component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. The severity of this issue is considered high. **Recommendations** For versions prior to 120.0.6099.62, update to version 120.0.6099.62 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages that could exploit the Media Stream component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.109 **Description** The issue is related to a use after free in WebRTC, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution or denial of service. The estimated number of potentially affected devices is not specified. **Recommendations** For Google Chrome versions prior to 120.0.6099.109, update to version 120.0.6099.109 or later to resolve the issue. As a temporary workaround, consider disabling WebRTC functionality until a patch is available. Restrict access to potentially malicious web pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.109 **Description** The issue is related to a use after free in Blink, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution or denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 120.0.6099.109, update to version 120.0.6099.109 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages that could trigger the heap corruption until a patch is applied. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 116.0.5845.110 **Description** The issue is related to a use after free in Vulkan, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 116.0.5845.110, update to version 116.0.5845.110 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages or disabling the Vulkan rendering mode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 115.0.5790.98 **Description** The issue is related to a use after free in WebRTC, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. The severity of this issue is considered high. **Recommendations** For versions prior to 115.0.5790.98, update to version 115.0.5790.98 or later to resolve the issue. As a temporary workaround, consider restricting access to WebRTC functionality until a patch is applied. Avoid using crafted HTML pages that could trigger the exploitation of heap corruption.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 115.0.5790.170 **Description** The issue is related to a use after free in the Cast component of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution or denial of service. **Recommendations** For versions prior to 115.0.5790.170, update to version 115.0.5790.170 or later to resolve the issue. As a temporary workaround, consider disabling the Cast feature until a patch is available. Restrict access to crafted HTML pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 110.0.5481.177 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free in Vulkan, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Google Chrome versions prior to 110.0.5481.177, update to version 110.0.5481.177 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 110.0.5481.177 Microsoft Edge (affected versions not specified) **Description** A heap buffer overflow issue in the Video component of Google Chrome and Microsoft Edge allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. The issue is related to an out-of-bounds operation in memory. **Recommendations** For Google Chrome versions prior to 110.0.5481.177, update to version 110.0.5481.177 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 110.0.5481.77 **Description** The issue is related to a use after free in the GPU, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. **Recommendations** For versions prior to 110.0.5481.77, update to version 110.0.5481.77 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 109.0.5414.119 **Description** The issue is related to a use after free in WebRTC, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The severity of this issue is considered high. **Recommendations** For versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider restricting access to WebRTC functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 109.0.5414.119 **Description** The issue is related to a use after free in WebTransport, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. The severity of this issue is considered high. **Recommendations** For versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider restricting access to WebTransport until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 104.0.5112.101 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free in SwiftShader, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page, allowing them to execute arbitrary code. **Recommendations** For Google Chrome versions prior to 104.0.5112.101, update to version 104.0.5112.101 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.