The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-lang/v8.Upgrade www-client/chromium. | Oct 30, 2017 | Dec 6, 2013 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Dec 12, 2013 | Dec 4, 2013 |
| Suse | — | Upgrade chromium-desktop-gnomeUpgrade chromium-desktop-kdeUpgrade chromium-ffmpegsumoUpgrade chromedriverUpgrade chromiumUpgrade chromium-suid-helper | Jan 9, 2014 | Dec 6, 2013 |
| Ubuntu | — | Upgrade chromium-browser | Nov 19, 2024 | Dec 7, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub