OSVDB ID: 86150 Title: Google Chrome IPC Layer TCMalloc Profile Files Arbitrary Write Sandbox Bypass |
Info |
|
|
Dates |
||||
|
|
Description |
Google Chrome contains a flaw related to the Inter-Process Communication (IPC) layer within the support of TCMalloc profile files. This may allow a context-dependent attacker to bypass the sandbox and write arbitrary files to e.g. tamper with user profiles by replacing bookmarks, preferences, and installed extension manifest files as well as the associated start files. |
Classification |
Location:
Context Dependent
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Upgrade Exploit: Exploit Private Disclosure: Vendor Verified, Coordinated Disclosure OSVDB: Vuln Dependent, Web Related |
Solution |
Upgrade to Google Chrome version 22.0.1229.94 or higher and Google Chrome OS version 21.0.1180.92 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |