Google Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions by leveraging access to a renderer process, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013, a different vulnerability than CVE-2013-6632.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 31.0.1650.57 are affected by the following vulnerabilities that have been shown to be exploitable for the purpose of remote code execution:

  - Unspecified integer overflow flaw (CVE-2013-6632)

  - A flaw in the ClipboardMessageFilter that can be triggered to bypass the Chrome sandbox and execute arbitrary code. (CVE-2013-6802)

ID	Name	Product	Family	Severity
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
801612	Google Chrome < 31.0.1650.57 Multiple Remote Code Execution Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2013-6802

critical

Tenable Plugins

critical

high