Multiple vulnerabilities have been reported in Google Chrome for Android, which can be exploited by malicious people to disclose certain sensitive information, conduct cross-site scripting attacks, and compromise a user's device.

1) An error within the "file://" URI handler can be exploited to disclose certain information and credentials.

2) An unspecified error can be exploited to conduct cross-site scripting attacks.

3) An error due to the application not properly restricting access to the API from JavaScript can be exploited to execute arbitrary Java methods.

Successful exploitation of this vulnerability requires that accessibility is enabled (disabled by default) and allows execution of arbitrary code via a specially crafted web page.

The vulnerabilities are reported in versions prior to 18.0.1025308.

Solution
Update to version 18.0.1025308 via Google Play.

Provided and/or discovered by
1, 2) Artem Chaykin, Positive Research
3) Takeshi Terada

Changelog
Further details available to Secunia VIM customers

Original Advisory
Google:
googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html

Positive Research:
http://en.securitylab.ru/lab/PT-2012-46
http://en.securitylab.ru/lab/PT-2012-47

Takeshi Terada:
http://archives.neohapsis.com/archives/bugtraq/2013-01/0025.html

Deep Links
Links available to Secunia VIM customers