Google Chrome V8 Await methods call ResolveNativePromise which calls InternalResolvePromise which can invoke a user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.
78b2c24ff6a8f61df29a3ac781ec2f32f86061d57afb7512f75393705b8644f1
Gentoo Linux Security Advisory 201804-22 - Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the execution of arbitrary code. Versions less than 66.0.3359.117 are affected.
c353629d367b741906fb92bc8f04662831005a826bbcd2a2e00f2f1d4211197f
Red Hat Security Advisory 2018-1195-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buffer overflow, bypass, remote shell upload, and use-after-free vulnerabilities.
fe526e6e61336ad0fc74b104cfcdf0a136e6f9ccc2cdbfb49335c9e148b97a09