Some vulnerabilities have been reported in Google Chrome, which can be exploited by malicious people to bypass certain security restrictions, disclose potentially sensitive information, conduct spoofing attacks, and compromise a user's system.

1) Certain unspecified homographic sequences can be used to spoof the URL bar.

2) The application did not properly restrict access to the clipboard, which can be exploited to e.g. set the clipboard content.

3) A stale pointer error exists related to SVG filters. Further information is currently not available.

4) An error when processing the "chrome-extension" protocol handler requests can be exploited to enumerate installed extensions.

5) A use-after-free error exists within the notification presenter. Further information is currently not available.

6) An unspecified error related to the notification permissions can be exploited to cause a memory corruption.

7) "Integer errors" exist related to WebSockets. Further information is currently not available.

8) An unspecified error related to counter nodes can be exploited to cause a memory corruption.

9) The application may store excessive autocomplete entries. Further information is currently not available.

10) A stale pointer error exists within the focus handling. Further information is currently not available.

11) An unspecified error exists within the sandbox parameter deserialisation.

12) An unspecified error can be exploited to conduct cross-origin image thefts.

Note: Additionally, an error related to WebSockets can be exploited to cause a "NULL crash" and the pop-up blocker can be bypassed via blank frame targets.

Solution
Fixed in version 6.0.472.53.

Provided and/or discovered by
4) Lostmon

The vendor also credits:
1) Chris Weber, Casaba Security
2) Brook Novak
3) Tavis Ormandy, Google Security Team
5) Sergey Glazunov
6) Michal Zalewski, Google Security Team and SkyLined, Google Chrome Security Team
7) Cris Neckar, Google Chrome Security Team and Keith Campbell
8) kuzzcc
9) Inferno, Google Chrome Security Team
10) Vupen
11) Ashutosh Mehra and Vineet Batra, Adobe Reader Sandbox Team
12) Isaac Dawson

The vendor also credits Marc Schoenefeld for his help regarding a workaround related to a Windows kernel vulnerability, which was previously incorrectly reported to be included in version 5.0.375.127.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html

Marc Schoenefeld:
http://www.marc-schoenefeld.de/vulns.html

Lostmon:
http://lostmon.blogspot.com/2010/09/google-chrome-instaled-extensions.html

Deep Links
Links available to Secunia VIM customers