Google Chrome V8 JavaScript Engine Remote Code Execution Vulnerability

Bugtraq ID:	36149
Class:	Unknown
CVE:	CVE-2009-2935
Remote:	Yes
Local:	No
Published:	Aug 25 2009 12:00AM
Updated:	Mar 19 2015 08:37AM
Credit:	Mozilla Security
Vulnerable:	Google Chrome 2.0.172 .37 Google Chrome 2.0.172 .33 Google Chrome 2.0.172 .31 Google Chrome 2.0.172 .30 Google Chrome 1.0.154 .61 Google Chrome 0.3.154 9 Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27 Google Chrome 1.0.154.65 Google Chrome 1.0.154.64 Google Chrome 1.0.154.59 Google Chrome 1.0.154.55 Google Chrome 1.0.154.53 Google Chrome 1.0.154.48 Google Chrome 1.0.154.46 Google Chrome 1.0.154.36
Not Vulnerable:	Google Chrome 2.0.172 .43

Google Chrome V8 JavaScript Engine Remote Code Execution Vulnerability

Google Chrome is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will allow the attacker to obtain sensitive information and execute arbitrary code in the Chrome sandbox. Failed attacks may cause denial-of-service conditions caused by a renderer (tab) crash.

This issue affects versions prior to Chrome 2.0.172.43.

Google Chrome V8 JavaScript Engine Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Chrome V8 JavaScript Engine Remote Code Execution Vulnerability

Solution:
The vendor has released a fix. Please see the references for details.

Google Chrome V8 JavaScript Engine Remote Code Execution Vulnerability

References:

• Google Chrome Homepage (Google)
  
• Stable Update: Security fixes (Google)