PT-2009-1391 · Google · Google Chrome

Published 2009-01-20 · Updated 2021-11-15 · CVE-2008-5915

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome (affected versions not specified)

Description The issue allows remote attackers to trick a user into acting upon a spoofed pop-up message, making it easier to conduct an "in-session phishing attack" when there is a current login to a website. This occurs due to an unspecified function in the JavaScript implementation creating and exposing a "temporary footprint".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-5915

Affected Products

Google Chrome

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-5915 · Security Note
• http://darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 · Note
• http://infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html · Note
• http://trusteer.com/files/In-session-phishing-advisory-2.pdf · Note
• http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html · Note
• http://securityfocus.com/bid/33276 · Note