CVE-2011-3881
published 2011-10-25CVE-2011-3881: WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.76%
75.7th percentile
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the Object::GetRealNamedPropertyInPrototypeChain function and use of an __proto__ property, (3) the HTMLPlugInImageElement::allowedToLoadFrameURL function and use of a javascript: URL, (4) incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and (5) improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | < 5.1 | 5.1 |
| apple | safari | < 5.1.4 | 5.1.4 |
| android | < 4.4 | 4.4 | |
| chrome | < 15.0.874.102 | 15.0.874.102 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h3qf-j7vv-gw2w: WebKit, as used in Google Chrome before 15
ghsa_unreviewed·2022-05-13
CVE-2011-3881 [MEDIUM] CWE-79 GHSA-h3qf-j7vv-gw2w: WebKit, as used in Google Chrome before 15
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the Object::GetRealNamedPropertyInPrototypeChain function and use of an __proto__ property, (3) the HTMLPlugInImageElement::allowedToLoadFrameURL function and use of a javascript: URL, (4) incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and (5) improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.
OSV
CVE-2011-3881: WebKit, as used in Google Chrome before 15
osv·2011-10-25·CVSS 4.3
CVE-2011-3881 [MEDIUM] CVE-2011-3881: WebKit, as used in Google Chrome before 15
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the Object::GetRealNamedPropertyInPrototypeChain function and use of an __proto__ property, (3) the HTMLPlugInImageElement::allowedToLoadFrameURL function and use of a javascript: URL, (4) incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and (5) improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://code.google.com/p/chromium/issues/detail?id=96047http://code.google.com/p/chromium/issues/detail?id=96885http://code.google.com/p/chromium/issues/detail?id=98053http://code.google.com/p/chromium/issues/detail?id=99512http://code.google.com/p/chromium/issues/detail?id=99750http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlhttp://lists.apple.com/archives/security-announce/2012/Mar/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2012/Mar/msg00003.htmlhttp://secunia.com/advisories/48288http://secunia.com/advisories/48377http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.htmlhttp://www.securitytracker.com/id?1026774https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117efhttps://exchange.xforce.ibmcloud.com/vulnerabilities/70959https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12940http://code.google.com/p/chromium/issues/detail?id=96047http://code.google.com/p/chromium/issues/detail?id=96885http://code.google.com/p/chromium/issues/detail?id=98053http://code.google.com/p/chromium/issues/detail?id=99512http://code.google.com/p/chromium/issues/detail?id=99750http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.htmlhttp://lists.apple.com/archives/security-announce/2012/Mar/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2012/Mar/msg00003.htmlhttp://secunia.com/advisories/48288http://secunia.com/advisories/48377http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.htmlhttp://www.securitytracker.com/id?1026774https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117efhttps://exchange.xforce.ibmcloud.com/vulnerabilities/70959https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12940
2011-10-25
Published