Vulnerability identifier: #VU44191

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3054

CWE-ID: CWE-269

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Chrome
Client/Desktop applications / Web browsers

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Chrome: 17.0.963.0 - 17.0.963.82

---

External links
http://code.google.com/p/chromium/issues/detail?id=117418
http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
http://osvdb.org/80292
http://secunia.com/advisories/48512
http://secunia.com/advisories/48527
http://security.gentoo.org/glsa/glsa-201203-19.xml
http://www.securityfocus.com/bid/52674
http://www.securitytracker.com/id?1026841
http://exchange.xforce.ibmcloud.com/vulnerabilities/74214
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15028

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.