Description
Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields input type.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | chromium-browser | 28.0.1500.95-1~deb7u1 | DSA-2732-1 |
Advisories 1
- DSA-2732-1 chromium-browser - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:17672 vdb-entry signature
- DSA-2732 vendor-advisory
- https://chromium.googlesource.com/chromium/blink/+/7a7ea525c912f6e59aa3e915e7f2cf140c077a49
- https://code.google.com/p/chromium/issues/detail?id=257353
- http://googlechromereleases.blogspot.com/2013/07/stable-channel-update_30.html
- https://chromium.googlesource.com/chromium/blink/+/dd13a061c49579e40f381b2dc9409fb0a920ec19%5E
- https://code.google.com/p/chromium/issues/detail?id=249640