The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade chromiumUpgrade chromium-npapiUpgrade chromium-pulse | Dec 10, 2025 | Dec 2, 2015 |
| Gentoo Linux | — | Upgrade www-client/chromium. | Oct 30, 2017 | Dec 5, 2015 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | May 9, 2019 | Dec 1, 2015 |
| Suse | — | Upgrade chromium | Dec 18, 2015 | Dec 5, 2015 |
| Ubuntu | — | Upgrade chromium-browser | Nov 19, 2024 | Dec 6, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub