5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.003 Low
EPSS
Percentile
71.4%
The NavigationScheduler::schedulePageBlock function in
core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome
before 38.0.2125.101, does not properly provide substitute data for pages
blocked by the XSS auditor, which allows remote attackers to obtain
sensitive information via a crafted web site.
googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
crbug.com/396544
launchpad.net/bugs/cve/CVE-2014-3197
nvd.nist.gov/vuln/detail/CVE-2014-3197
security-tracker.debian.org/tracker/CVE-2014-3197
src.chromium.org/viewvc/blink?revision=179240&view=revision
ubuntu.com/security/notices/USN-2345-1
www.cve.org/CVERecord?id=CVE-2014-3197