KLA11787 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. Use after free vulnerability in reader mode can be exploited to potentially cause denial of service.
2. Policy enforcement vulnerability in developer tools can be exploited to bypass same origin policy.
3. Implementation vulnerability in full screen component can be exploited to potentially execute arbitrary code.
4. Data validation vulnerability in ChromeDriver can be exploited to bypass security restrictions.
5. Policy enforcement vulnerability in payments component can be exploited to bypass same origin policy.
6. Use after free vulnerability in WebRTC can be exploited to potentially cause denial of service.
7. Type confusion vulnerability in V8 can be exploited to potentially cause denial of service.
8. Implementation vulnerability in developer tools can be exploited ti potentially execute arbitrary code.
9. Policy enforcement vulnerability in Blink can be exploited to bypass same origin policy.
10. Data validation vulnerability in clipboard component can be exploited to obtaion sensitive information.
11. Data validation vulnerability in loader component can be exploited to bypass security restrictions.
12. Policy enforcement vulnerability in enterprice component can be exploited to bypass same origin policy.
13. Implementation vulnerability in installer component can be exploited to potentially execute arbitrary code.
14. Implementation vulnerability in sharing component can be exploited to potentially execute arbitrary code.
15. Policy enforcement vulnerability in downloads component can be exploited to bypass same origin policy.
16. Security UI vulnerability in full screen component can be exploited to perform domain spoofing.
17. Security UI vulnerability in site information component can be exploited to perform domain spoofing.
18. Policy enforcement vulnerability in navigations component can be exploited to bypass same origin policy.
19. Use after free vulnerability in Blink can be exploited ti potentially cause denial of service.
20. Data validation vulnerability in media router can be exploited to bypass security restrictions.
21. Policy enforcement vulnerability in URL formatting component can be exploited to bypass same origin policy.
22. Use after free vulnerability in media component can be exploited to potentially cause denial of service.
23. Policy enforcement vulnerability in tab strip component can be exploited to bypass same origin policy.

Original advisories

Stable Channel Update for Desktop

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Google-Chrome

CVE list

CVE-2020-6465 high

CVE-2020-6471 high

CVE-2020-6478 warning

CVE-2020-6484 warning

CVE-2020-6483 warning

CVE-2020-6467 high

CVE-2020-6468 high

CVE-2020-6489 warning

CVE-2020-6473 warning

CVE-2020-6470 warning

CVE-2020-6490 warning

CVE-2020-6469 high

CVE-2020-6480 warning

CVE-2020-6477 warning

CVE-2020-6479 warning

CVE-2020-6487 warning

CVE-2020-6475 warning

CVE-2020-6491 warning

CVE-2020-6486 warning

CVE-2020-6474 high

CVE-2020-6485 warning

CVE-2020-6481 warning

CVE-2020-6466 high

CVE-2020-6488 warning

CVE-2020-6476 warning

CVE-2020-6482 warning

CVE-2020-6472 warning

Solution

Update to the latest version

Download Google Chrome

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Google Chrome earlier than 83.0.4103.61