NVD

Id
10449  
Name
CVE-2011-3881  
Description
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the Object::GetRealNamedPropertyInPrototypeChain function and use of an __proto__ property, (3) the HTMLPlugInImageElement::allowedToLoadFrameURL function and use of a javascript: URL, (4) incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and (5) improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-10-25  
Modified Date
2014-10-04  
Seq
2011-3881  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
59299 10449 CVE-2011-3881 http://code.google.com/p/chromium/issues/detail?id=96047  View
59300 10449 CVE-2011-3881 http://code.google.com/p/chromium/issues/detail?id=96885  View
59301 10449 CVE-2011-3881 http://code.google.com/p/chromium/issues/detail?id=98053  View
59302 10449 CVE-2011-3881 http://code.google.com/p/chromium/issues/detail?id=99512  View
59303 10449 CVE-2011-3881 http://code.google.com/p/chromium/issues/detail?id=99750  View
59304 10449 CVE-2011-3881 http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html  View
59305 10449 CVE-2011-3881 APPLE-SA-2012-03-07-2  View
59306 10449 CVE-2011-3881 APPLE-SA-2012-03-12-1  View
59307 10449 CVE-2011-3881 oval:org.mitre.oval:def:12940  View
59308 10449 CVE-2011-3881 http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html  View
59309 10449 CVE-2011-3881 google-chrome-security-bypass(70959)  View
59310 10449 CVE-2011-3881 https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32432 JVNDB-2011-002672 複数の製品で使用される Webkit における同一生成元ポリシーを回避される脆弱性 複数の製品で使用される Webkit には、同一生成元ポリシー (Same origin policy) を回避される脆弱性が存在します。 CVE-2011-3881 51788 CVE-2011-3881 10449 6.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002672.html 2011-10-25 2012-03-21 View