Gentoo update for Chromium, Google Chrome, Microsoft Edge. Opera

1) Heap-based buffer overflow

EUVDB-ID: #VU86198

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-1283

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Skia. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU86197

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-1284

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Mojo component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU99494

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-10487

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Dawn. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU99495

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-10488

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebRTC component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improperly implemented security check for standard

EUVDB-ID: #VU100313

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-11110

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Blink in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improperly implemented security check for standard

EUVDB-ID: #VU100314

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-11111

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU100315

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-11112

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Media in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU100316

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-11113

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Accessibility in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improperly implemented security check for standard

EUVDB-ID: #VU100317

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-11114

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Views in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU100318

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-11115

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Navigation in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improperly implemented security check for standard

EUVDB-ID: #VU100319

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-11116

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improperly implemented security check for standard

EUVDB-ID: #VU100320

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-11117

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in FileSystem in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Type Confusion

EUVDB-ID: #VU101839

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-12692

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU101840

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-12693

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU101841

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-12694

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Compositing component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds write

EUVDB-ID: #VU101842

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-12695

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Type Confusion

EUVDB-ID: #VU102431

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0291

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Buffer overflow

EUVDB-ID: #VU102764

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0434

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Improperly implemented security check for standard

EUVDB-ID: #VU102765

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-0435

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Navigation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Integer overflow

EUVDB-ID: #VU102766

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0436

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Skia component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Out-of-bounds read

EUVDB-ID: #VU102767

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-0437

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Metrics component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Stack-based buffer overflow

EUVDB-ID: #VU102768

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0438

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Tracing in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Race condition

EUVDB-ID: #VU102769

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0439

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a race condition in Frames in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and bypass implemented security restrictions.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improperly implemented security check for standard

EUVDB-ID: #VU102770

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0440

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Fullscreen in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improperly implemented security check for standard

EUVDB-ID: #VU102771

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0441

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Fenced Frames in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Improperly implemented security check for standard

EUVDB-ID: #VU102772

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0442

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Payments in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU102773

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-0443

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Improperly implemented security check for standard

EUVDB-ID: #VU102774

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-0446

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improperly implemented security check for standard

EUVDB-ID: #VU102775

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-0447

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Navigation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Improperly implemented security check for standard

EUVDB-ID: #VU102776

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-0448

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Compositing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Use-after-free

EUVDB-ID: #VU103414

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-0762

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within DevTools in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Type Confusion

EUVDB-ID: #VU105486

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-1920

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Type Confusion

EUVDB-ID: #VU105487

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2025-2135

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

34) Use-after-free

EUVDB-ID: #VU105490

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-2136

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Inspector component. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Out-of-bounds read

EUVDB-ID: #VU105489

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-2137

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU105878

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-2476

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Lens component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.
www-client/chromium to version: 134.0.6998.117
www-client/google-chrome to version: 134.0.6998.117
www-client/microsoft-edge to version: 134.0.3124.83
www-client/opera to version: 119.0.5497.12

Vulnerable software versions

Gentoo Linux: All versions

www-client/opera: before 119.0.5497.12

www-client/microsoft-edge: before 134.0.3124.83

www-client/google-chrome: before 134.0.6998.117

www-client/chromium: before 134.0.6998.117

CPE2.3

External links

https://security.gentoo.org/glsa/202507-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	36
CVE-ID	CVE-2024-1283 CVE-2024-1284 CVE-2024-10487 CVE-2024-10488 CVE-2024-11110 CVE-2024-11111 CVE-2024-11112 CVE-2024-11113 CVE-2024-11114 CVE-2024-11115 CVE-2024-11116 CVE-2024-11117 CVE-2024-12692 CVE-2024-12693 CVE-2024-12694 CVE-2024-12695 CVE-2025-0291 CVE-2025-0434 CVE-2025-0435 CVE-2025-0436 CVE-2025-0437 CVE-2025-0438 CVE-2025-0439 CVE-2025-0440 CVE-2025-0441 CVE-2025-0442 CVE-2025-0443 CVE-2025-0446 CVE-2025-0447 CVE-2025-0448 CVE-2025-0762 CVE-2025-1920 CVE-2025-2135 CVE-2025-2136 CVE-2025-2137 CVE-2025-2476
CWE-ID	CWE-122 CWE-416 CWE-787 CWE-358 CWE-264 CWE-843 CWE-119 CWE-190 CWE-125 CWE-121 CWE-362 CWE-20
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #33 is available.
Vulnerable software	Gentoo Linux Operating systems & Components / Operating system www-client/opera Operating systems & Components / Operating system package or component www-client/microsoft-edge Operating systems & Components / Operating system package or component www-client/google-chrome Operating systems & Components / Operating system package or component www-client/chromium Operating systems & Components / Operating system package or component
Vendor	Gentoo