extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Chrome | * | 50.0.2661.87 (including) |