CVE-2010-1236

The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit
before r55822, as used in Google Chrome before 4.1.249.1036 and Flock
Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the
beginning of a URL, which allows remote attackers to conduct cross-site
scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a
\x00javascript:alert sequence.

Bugs

• <https://bugs.webkit.org/show_bug.cgi?id=35948&gt;
• <http://code.google.com/p/chromium/issues/detail?id=37383&gt;