CVE-2014-7906

Use-after-free vulnerability in the Pepper plugins in Google Chrome before 39.0.2171.65 allows...

7.5 High

CVE-2014-7906 is a high vulnerability (CVSS 7.5) in Google Chrome, published November 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. No source names a fixed version.

What does this mean?

Severity: 7.5 HighCVSS 2.0, NVD
Exploit chance: 1.86%EPSS, 79th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

Use-after-free vulnerability in the Pepper plugins in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime.

Exploit likelihood

1.86%Up 0.5 points since Feb 4, 2022

Affected products

google chrome

Affected packages

Affected packages
Package	Affected	Fixed
`chromium-browser-stable` Mageia:3 From an advisory covering 6 CVEs	before 39.0.2171.65-1.mga3	39.0.2171.65-1.mga3
`chromium-browser-stable` Mageia:3 From an advisory covering 6 CVEs	before 39.0.2171.65-1.mga3.tainted	39.0.2171.65-1.mga3.tainted
`chromium-browser-stable` Mageia:4 From an advisory covering 6 CVEs	before 39.0.2171.65-1.mga4	39.0.2171.65-1.mga4
`chromium-browser` Red Hat:rhel_extras:6 From an advisory covering 7 CVEs	before 0:39.0.2171.65-2.el6_6	0:39.0.2171.65-2.el6_6
`chromium-browser-debuginfo` Red Hat:rhel_extras:6 From an advisory covering 7 CVEs	before 0:39.0.2171.65-2.el6_6	0:39.0.2171.65-2.el6_6
`chromium` openSUSE:Tumbleweed From an advisory covering 719 CVEs	before 55.0.2883.75-3.1	55.0.2883.75-3.1
`chromium` openSUSE:Tumbleweed From an advisory covering 2310 CVEs	before 113.0.5672.92-1.1	113.0.5672.92-1.1

What each source reports

NVD Score used7.5

Record: CVE-2014-7906
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2014-7906
Updated: 2026-11-02

EUVDEUVD-2014-7756No score

Record: EUVD-2014-7756
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rff6-5r42-5rpmNo score

Use-after-free vulnerability in the Pepper plugins in Google Chrome before 39.0.2171.65 allows...

Record: GHSA-rff6-5r42-5rpm
Updated: 2026-11-02

OSVMGASA-2014-0485No score

Updated chromium-browser-stable fixes multiple security vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities:

Buffer overflow in Skia, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors (CVE-2014-7904).

Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the lock and unlock methods (CVE-2014-7907).

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data (CVE-2014-7908).

effects/SkDashPathEffect.cpp in Skia, as used in Google Chrome before 39.0.2171.65, computes a hash key using uninitialized integer values, which might allow remote attackers to cause a denial of service by rendering crafted data (CVE-2014-7909).

Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2014-7910).

Record: MGASA-2014-0485
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10171-1No score

chromedriver-55.0.2883.75-3.1 on GA media

These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.