Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade webkit-gtk2 | Dec 10, 2025 | Jul 18, 2010 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Jun 11, 2012 | Sep 24, 2010 |
| Suse | — | Upgrade libwebkit-1_0-2Upgrade libwebkit-1_0-2-32bitUpgrade libwebkit-develUpgrade webkit-jscUpgrade libwebkit-lang | Feb 17, 2015 | Sep 24, 2010 |
| Ubuntu | — | Upgrade webkitUpgrade chromium-browser | Nov 19, 2024 | Sep 24, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub