| Max CVSS | 6.8 | Min CVSS | 4.3 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2016-1627 | 6.8 |
The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 | |
| CVE-2016-1626 | 4.3 |
The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a craft
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 | |
| CVE-2016-1622 | 6.8 |
The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript cod
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 | |
| CVE-2016-1623 | 6.8 |
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web s
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 | |
| CVE-2016-1624 | 6.8 |
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via c
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 | |
| CVE-2016-1625 | 4.3 |
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vec
|
30-10-2018 - 16:27 | 14-02-2016 - 02:59 |