CVE-2014-3166 — Sensitive Information Exposure in Google Chrome

CWE-200 — Sensitive Information Exposure5 documents4 sources
Severity
4.3MEDIUMNVD
OSV7.5
EPSS
1.2%
top 21.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeDebian Linux
Timeline
PublishedAug 13
Latest updateMay 14

Description

The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome< 36.0.1985.143+2

Also affects: Debian Linux 7.0, 8.0

🔴Vulnerability Details

3
GHSA
GHSA-7mjp-hj3c-3vxc: The Public Key Pinning (PKP) implementation in Google Chrome before 36↗2022-05-14
▶
OSV
oxide-qt vulnerabilities↗2014-08-20
▶
OSV
CVE-2014-3166: The Public Key Pinning (PKP) implementation in Google Chrome before 36↗2014-08-13
▶

📋Vendor Advisories

1
Ubuntu
Oxide vulnerabilities↗2014-08-20
▶