The host is installed with Google Chrome before 41.0.2272.76 and is prone to multiple use-after-free vulnerabilities. The flaws are present in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome, which fails to properly handle vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp. Successful exploitation allows remote attackers to cause a denial of service or possibly have unspecified other impact.