The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink as used in Google Chrome before 49.0.2623.87 does not properly maintain the user agent shadow DOM which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage \type confusion.\