CVE-2011-3046 The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)"....
HighCVSS 10.0
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | < 17.0.963.78 | 17.0.963.78 |
| opensuse | = 12.1 | No fix listed |
| apple Safari | < 5.1.7 | 5.1.7 |
| apple iphone os | < 5.1.1 | 5.1.1 |
References
- code.google.com vendor-advisory
- code.google.com vendor-advisory
- googlechromereleases.blogspot.com release-notes vendor-advisory
- APPLE-SA-2012-05-07-1 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2012-05-09-2 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2012:0374 mailing-list third-party-advisory vendor-advisory
- 47292 not-applicable third-party-advisory
- 48321 not-applicable third-party-advisory
- 48419 not-applicable third-party-advisory
- 48527 not-applicable third-party-advisory
- GLSA-201203-19 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- 52369 third-party-advisory vdb-entry
- 1026776 third-party-advisory vdb-entry
- www.zdnet.com press-media-coverage
- oval:org.mitre.oval:def:14686 signature third-party-advisory vdb-entry
- plus.google.com permissions-required vendor-advisory