PT-2011-4752 · Google+1 · Google Chrome+2
Sergey Glazunov
·
Publicado
2011-10-25
·
Atualizado
2020-05-11
·
CVE-2011-3881
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 15.0.874.102
Android versions prior to 4.4
Description
The issue allows remote attackers to bypass the Same Origin Policy, enabling them to conduct Universal XSS (UXSS) attacks. This can be achieved through various vectors, including the use of the
DOMWindow::clear function with a selection object, the Object::GetRealNamedPropertyInPrototypeChain function with an proto property, the HTMLPlugInImageElement::allowedToLoadFrameURL function with a javascript: URL, incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.Recommendations
For Google Chrome versions prior to 15.0.874.102, update to version 15.0.874.102 or later to resolve the issue.
For Android versions prior to 4.4, update to version 4.4 or later to resolve the issue.
As a temporary workaround, consider restricting the use of
javascript: URLs and synchronous frame loads until a patch is available.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Android
Google Chrome
Safari