Google has released Chrome 127.0.6533.88, which fixes three vulnerabilities, including a critical vulnerability (CVE-2024-6990) that allows bypassing all layers of browser protection and executing code on the system outside of the sandbox environment. Details are not yet disclosed, but it is known that the critical vulnerability is related to the use of uninitialized values in the Dawn component that implements the WebGPU specification.
The other two vulnerabilities are marked as dangerous and are related to reading from memory outside the buffer in the WebTransport API implementation (CVE-2024-7255) and insufficient input validation in the Dawn component (CVE-2024-7256).
Source: opennet.ru
