Google Chrome before 10.0.648.127 does not prevent (1) navigation and (2) close operations on the top location of a sandboxed frame, which has unspecified impact and remote attack vectors.

Versions of Google Chrome earlier than 10.0.648.127 are potentially affected by multiple vulnerabilities :

  - It may be possible to navigate or close the top location in a sandboxed frame. (42574, 42765)

  -  An X server bug exists which could cause the application to crash with long messages.  Note that this issue only affects Google Chrome on Linux. (49747)

  - It is possible to crash the browser with parallel prints.  Note that this issue only affects Google Chrome on Linux. (66962)

  - A cross-origin error message leak exists (69187)

  - A memory corruption issue exists with counter nodes. (69628)

  - An unspecified issue exists with stale nodes in box layout. (70027)

  - A cross-origin error message leak exists with workers. (70336)

  - A use-after-free error exists with DOM URL handling. (70442)

  - An out-of-bounds read exists when handling unicode ranges. (70779)

  - A same origin policy bypass exists in V8. (70877)

  - It may be possible to bypass the pop-up blocker. (70885, 71167)

  - A use-after-free error exists in document script lifetime handling. (71763)

  - An out-of-bounds write issue exists in the OGG container. (71788)

  - A stale pointer exists in table painting. (72028)

  - A corrupt out-of-bounds structure may be used in video code. (73026)

  - It may be possible to crash the application with the DataView object. (73066)

  - A bad cast exists in text rendering. (73134)

  - A stale pointer exists in the WebKit context code. (73196)

  - It may be possible for heap addresses to leak in XSLT. (73716)

  - A stale pointer exists with SVG cursors. (73746)

  - It is possible for the DOM tree to be corrupted with attribute handling. (74030)

  - An unspecified corruption exists via re-entrancy of RegExp code. (74662)

  - An invalid memory access exists in v8. (74675)

The version of Google Chrome installed on the remote host is earlier than 10.0.648.127.  Such versions are reportedly affected by multiple vulnerabilities :

  - It may be possible to navigate or close the top location     in a sandboxed frame. (Issue #42574, #42765)

  - A cross-origin error message leak exists. (Issue #69187)

  - A memory corruption issue exists with counter nodes.
    (Issue #69628)

  - An unspecified issue exists with stale nodes in box     layout. (Issue #70027)

  - A cross-origin error message leak exists with workers.
    (Issue #70336)

  - A use-after-free error exists with DOM URL handling.
    (Issue #70442)

  - A same origin policy bypass exists in v8. (Issue #70877)

  - It may be possible to bypass the pop-up blocker.
    (Issue #70885, #71167)

  - A use-after-free error exists in document script     lifetime handling. (Issue #71763)

  - An out-of-bounds write issue exists in the OGG     container. (Issue #71788)

  - A stale pointer exists in table painting. (Issue #72028)

  - A corrupt out-of-bounds structure may be used in video     code. (Issue #73026)

  - It may be possible to crash the application with the     DataView object. (Issue #73066)

  - A bad cast exists in text rendering. (Issue #73134)

  - A stale pointer exists in the WebKit context code.
    (Issue #73196)

  - It may be possible for heap addresses to leak in XSLT.
    (Issue #73716)

  - A stale pointer exists with SVG cursors. (Issue #73746)

  - It is possible for the DOM tree to be corrupted with     attribute handling. (Issue #74030)

  - An unspecified corruption exists via re-entrancy of     RegExp code. (Issue #74662)

  - An invalid memory access exists in v8. (Issue #74675)

ID	Name	Product	Family	Severity
800960	Google Chrome < 10.0.648.127 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5812	Google Chrome < 10.0.648.127 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
52589	Google Chrome < 10.0.648.127 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2011-1185

critical

Tenable Plugins

high

high

medium