Multiple integer overflows in Skia, as used in Google Chrome before 4.0.249.78, allow remote attackers to execute arbitrary code in the Chrome sandbox or cause a denial of service (memory corruption and application crash) via vectors involving CANVAS elements.
- http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
No PoCs found on GitHub currently.