CVE-2011-2335 Use after free in Chrome

What is CVE-2011-2335?

CVE-2011-2335 is a high-severity use after free vulnerability in Google Chrome, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function.

Weakness: CWE-415

Which versions are affected by CVE-2011-2335?

It affects 1 product.

Products include Google Blink.

How do I fix CVE-2011-2335?

No fix has been published for CVE-2011-2335 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2011-2335 being exploited?

There is no known exploitation of CVE-2011-2335 in the wild and no public exploit code.

Other vulnerabilities in Google Chrome

• CVE-2011-2337 Integer overflow in Chrome on 64-bit platforms Critical 9.8
• CVE-2011-1460 Memory corruption in n/a Critical 9.8
• CVE-2011-1298 Integer overflow in n/a High 7.5
• CVE-2011-1802 Memory corruption in Chrome Medium 6.5
• CVE-2011-1803 Use after free in Chrome Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7pfw-rp8m-2c7m.