The vulnerability of Google Chrome browser allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp of Blink for Google Chrome. It stems from an improper limitation on resource requests related to SVG files. Exploiting this vulnerability allows malicious actors to circumvent domain restriction...

CVE-2014-3160

CVE-2014-3160 affects Chromium/Blink: the ResourceFetcher::canRequest logic allowed subresource SVG requests to bypass Same Origin Policy. This is a remote-origin bypass via crafted SVG files in Chrome prior to 36.0.1985.125. Public advisories (Debian, openSUSE, Gentoo, Ubuntu) document the issue...

CVE-2014-3160: Undefined Security Weakness

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file...