A use-after-free vulnerability in the SVG implementation in Blink, affecting Google Chrome versions prior to 35.0.1916.114, allows remote attackers to cause a denial of service or potentially have other unspecified impacts. This vulnerability is related to the removal of an SVGFontFaceElement object, which can be exploited through specific vectors.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2014-1745 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious SVG file that triggers the use-after-free condition in the browser. By hosting this file on a web server and enticing users to visit the page, the attacker can cause the browser to crash or potentially execute arbitrary code, leading to a denial of service or other impacts.
Affected Products
- Google Chrome (versions before 35.0.1916.114) – Vulnerable due to the use-after-free issue in the SVG implementation.
Mitigation
Users are advised to update their Google Chrome browser to the latest version to mitigate this vulnerability. Regular updates ensure that security patches are applied, reducing the risk of exploitation.