Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c readconfig implementation that loads the contents of the .pangorc file in the user's home directory, and the file referenced by the PANGORCFILE environment variable, which allows attackers to bypass intended access restrictions via crafted configuration data.

Use-after-free vulnerability in the O3D plug-in in Google Chrome OS before 26.0.1410.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper management of ownership relationships involving Elements and DrawElements.