WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote malicious users to cause a denial of service (memory corruption).
google blink