CVE-2014-7939

2015-01-2222:59:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-7939

google chrome

same origin policy

javascript

proxy.create

console.log

http responses

x-content-type-options

nosniff

security vulnerability

8.8 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

75.8%

JSON

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an “X-Content-Type-Options: nosniff” header.

CPENameOperatorVersion
google:chromegoogle chromele40.0.2214.85
chromium:chromiumchromiumeq40.0.2214.110
redhat:enterprise_linux_desktop_supplementaryredhat enterprise linux desktop supplementaryeq6.0
redhat:enterprise_linux_server_supplementaryredhat enterprise linux server supplementaryeq6.0
redhat:enterprise_linux_workstation_supplementaryredhat enterprise linux workstation supplementaryeq6.0
redhat:enterprise_linux_server_supplementary_eusredhat enterprise linux server supplementary euseq6.6.z
opensuse:opensuseopensuseeq13.1
opensuse:opensuseopensuseeq13.2

CPE	Name	Operator	Version
google:chrome	google chrome	le	40.0.2214.85
chromium:chromium	chromium	eq	40.0.2214.110
redhat:enterprise_linux_desktop_supplementary	redhat enterprise linux desktop supplementary	eq	6.0
redhat:enterprise_linux_server_supplementary	redhat enterprise linux server supplementary	eq	6.0
redhat:enterprise_linux_workstation_supplementary	redhat enterprise linux workstation supplementary	eq	6.0
redhat:enterprise_linux_server_supplementary_eus	redhat enterprise linux server supplementary eus	eq	6.6.z
opensuse:opensuse	opensuse	eq	13.1
opensuse:opensuse	opensuse	eq	13.2