CVEvulnerability

CVE-2010-1236

4.3 MEDIUM Published 2010-04-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-04-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \x00javascript:alert sequence.

Affected configurations

• google chrome (<= 4.1.249.1035) • google chrome 0.1.38.1 • google chrome 0.1.38.2 • google chrome 0.1.38.4 • google chrome 0.1.40.1 • google chrome 0.1.42.2 • google chrome 0.1.42.3 • google chrome 1.0.154.53 • google chrome 1.0.154.59 • google chrome 1.0.154.64 • google chrome 1.0.154.65 • google chrome 2.0.169.0 • google chrome 2.0.169.1 • google chrome 2.0.170.0 • google chrome 2.0.172.2 • google chrome 2.0.172.8 • google chrome 2.0.172.27 • google chrome 2.0.172.28 • google chrome 2.0.172.30 • google chrome 2.0.172.33 • google chrome 2.0.172.37 • google chrome 2.0.172.38 • google chrome 3.0.182.2 • google chrome 3.0.190.2 • google chrome 3.0.195.25 • google chrome 3.0.195.27 • google chrome 3.0.195.33 • google chrome 3.0.195.36 • google chrome 3.0.195.37 • google chrome 3.0.195.38 • google chrome 4.0.212.0 • google chrome 4.0.212.1 • google chrome 4.0.221.8 • google chrome 4.0.222.0 • google chrome 4.0.222.1 • google chrome 4.0.222.5 • google chrome 4.0.222.12 • google chrome 4.0.223.0 • google chrome 4.0.223.1 • google chrome 4.0.223.2 • google chrome 4.0.223.4 • google chrome 4.0.223.5 • google chrome 4.0.223.7 • google chrome 4.0.223.8 • google chrome 4.0.223.9 • google chrome 4.0.224.0 • google chrome 4.0.229.1 • google chrome 4.0.235.0 • google chrome 4.0.236.0 • google chrome 4.0.237.0 • google chrome 4.0.237.1 • google chrome 4.0.239.0 • google chrome 4.0.240.0 • google chrome 4.0.241.0 • google chrome 4.0.242.0 • google chrome 4.0.243.0 • google chrome 4.0.244.0 • google chrome 4.0.245.0 • google chrome 4.0.245.1 • google chrome 4.0.246.0 … and 164 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References