An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Blink | * | m11 (excluding) | |
| Qtwebkit | Ubuntu | trusty | * |
| Qtwebkit-opensource-src | Ubuntu | trusty | * |
| Qtwebkit-source | Ubuntu | trusty | * |
| Webkitgtk | Ubuntu | trusty | * |