Google Chrome is prone to a flaw in the way it loads NPAPI plugins such as the Windows Media Player plugin. The program uses a fixed path to look for specific files or libraries. This path includes directories (e.g. '%SYSTEMROOT%\PFiles\Plugins\') that may not be trusted or under user control. By placing a custom version of the file or library in the path, the program will load it before the legitimate version. This allows a local attacker to inject custom code that will be run with the privilege of the program or user executing the program.

Upgrade to version 19.0.1084.46 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027067
• OVAL ID: 15618
• CVE ID: 2011-3098 (see also: NVD)
• Secunia Advisory ID: 49194 49278 49420 50307
• Bugtraq ID: 53540
• Related OSVDB ID: 81945 81946 81947 81948 81949 81950 81951 81952 81953 81954 81955 81956 81957 81958 81959 81961 81962 81963 81964
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=124216 [ Auth Req'd ]
  http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html
  http://lists.opensuse.org/opensuse-updates/2012-05/msg00040.html
  http://lists.opensuse.org/opensuse-updates/2012-08/msg00026.html
  http://www.srware.net/forum/viewtopic.php?f=18&t=3729
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00009.html
• Other Advisory URL: http://technet.microsoft.com/en-us/security/msvr/msvr12-008

• Haifei Li - Microsoft Vulnerability Research