#VU33974 Input validation error in Google Chrome - CVE-2010-2646

Vulnerability identifier: #VU33974

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2010-2646

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Chrome
Client/Desktop applications / Web browsers

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Google Chrome before 5.0.375.99 does not properly isolate sandboxed IFRAME elements, which has unspecified impact and remote attack vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Chrome: 1.0.154.53 - 5.0.375.97

---

External links
https://code.google.com/p/chromium/issues/detail?id=42575
https://code.google.com/p/chromium/issues/detail?id=42980
https://googlechromereleases.blogspot.com/2010/07/stable-channel-update.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11981

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.