Google Chrome before 10.0.648.127 does not properly perform box layout which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale node.\