apk package

wolfi/chromium

pkg:apk/wolfi/chromium

Vulnerabilities (2,281)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2024-9964	Med	4.3	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVE-2024-9963	Med	4.3	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9962	Med	4.3	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9961	Hig	8.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9960	Hig	7.5	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9959	Hig	8.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2024-9958	Med	4.3	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9957	Hig	8.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9956	Hig	7.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9955	Hig	8.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9954	Hig	8.8	< 130.0.6723.58-r0	130.0.6723.58-r0	Oct 15, 2024	Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9859	Hig	8.8	< 126.0.6478.126-r0	126.0.6478.126-r0	Oct 11, 2024	Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9603	Hig	8.8	< 134.0.6998.117-r0	134.0.6998.117-r0	Oct 8, 2024	Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9602	Hig	8.8	< 134.0.6998.117-r0	134.0.6998.117-r0	Oct 8, 2024	Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9123	Hig	8.8	< 129.0.6668.70-r0	129.0.6668.70-r0	Sep 25, 2024	Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9122	Hig	8.8	< 129.0.6668.70-r0	129.0.6668.70-r0	Sep 25, 2024	Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9121	Hig	8.8	< 129.0.6668.70-r0	129.0.6668.70-r0	Sep 25, 2024	Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9120	Hig	8.8	< 129.0.6668.70-r0	129.0.6668.70-r0	Sep 25, 2024	Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-7024	Cri	9.6	< 126.0.6478.54-r0	126.0.6478.54-r0	Sep 23, 2024	Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2024-7023	Hig	8.8	< 128.0.6537.0-r0	128.0.6537.0-r0	Sep 23, 2024	Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

CVE-2024-9964MedOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVE-2024-9963MedOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9962MedOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9961HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9960HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9959HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2024-9958MedOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9957HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9956HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9955HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-9954HigOct 15, 2024
affected < 130.0.6723.58-r0fixed 130.0.6723.58-r0
Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9859HigOct 11, 2024
affected < 126.0.6478.126-r0fixed 126.0.6478.126-r0
Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9603HigOct 8, 2024
affected < 134.0.6998.117-r0fixed 134.0.6998.117-r0
Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9602HigOct 8, 2024
affected < 134.0.6998.117-r0fixed 134.0.6998.117-r0
Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9123HigSep 25, 2024
affected < 129.0.6668.70-r0fixed 129.0.6668.70-r0
Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9122HigSep 25, 2024
affected < 129.0.6668.70-r0fixed 129.0.6668.70-r0
Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9121HigSep 25, 2024
affected < 129.0.6668.70-r0fixed 129.0.6668.70-r0
Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2024-9120HigSep 25, 2024
affected < 129.0.6668.70-r0fixed 129.0.6668.70-r0
Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-7024CriSep 23, 2024
affected < 126.0.6478.54-r0fixed 126.0.6478.54-r0
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2024-7023HigSep 23, 2024
affected < 128.0.6537.0-r0fixed 128.0.6537.0-r0
Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

Page 105 of 115