CVEvulnerability

CVE-2009-3011

4.3 MEDIUM Published 2009-08-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-08-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. NOTE: the JavaScript executes outside of the context of the HTTP site.

Affected configurations

• google chrome (<= 1.0.154.48) • google chrome 0.2.149.27 • google chrome 0.2.149.29 • google chrome 0.2.149.30 • google chrome 0.2.152.1 • google chrome 0.2.153.1 • google chrome 0.3.154.0 • google chrome 0.3.154.3 • google chrome 0.4.154.18 • google chrome 0.4.154.22 • google chrome 0.4.154.31 • google chrome 0.4.154.33 • google chrome 1.0.154.36 • google chrome 1.0.154.39 • google chrome 1.0.154.42 • google chrome 1.0.154.43 • google chrome 1.0.154.46 • google chrome 2.0.172.28 • google chrome 2.0.172.37 • google chrome 3.0.193.2

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References