Origin validation error in Google Chrome - CVE-2011-3956
Published: February 9, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU44313
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-3956
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.
Affected software
Google Chrome
Gentoo Linux
Gentoo Linux
How to mitigate CVE-2011-3956
Install update from vendor's website.
Google Chrome - update to 17.0.963.46