Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with CANVAS elements which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\