CVE-2014-7939
published 2015-01-22CVE-2014-7939: Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.56%
83.5th percentile
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | — | — |
| chrome | <= 40.0.2214.85 | — | |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop_supplementary | — | — |
| redhat | enterprise_linux_server_supplementary | — | — |
| redhat | enterprise_linux_server_supplementary_eus | — | — |
| redhat | enterprise_linux_workstation_supplementary | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m956-r3pg-f666: Google Chrome before 40
ghsa_unreviewed·2022-05-14
CVE-2014-7939 [MEDIUM] GHSA-m956-r3pg-f666: Google Chrome before 40
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
OSV
CVE-2014-7939: Google Chrome before 40
osv·2015-01-22·CVSS 4.3
CVE-2014-7939 [MEDIUM] CVE-2014-7939: Google Chrome before 40
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Red Hat
chromium-browser: same-origin-bypass in V8
vendor_redhat·2015-01-21·CVSS 4.3
CVE-2014-7939 [MEDIUM] chromium-browser: same-origin-bypass in V8
chromium-browser: same-origin-bypass in V8
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2015/01/stable-update.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0093.htmlhttp://secunia.com/advisories/62383http://secunia.com/advisories/62665http://security.gentoo.org/glsa/glsa-201502-13.xmlhttp://www.securityfocus.com/bid/72288http://www.securitytracker.com/id/1031623https://code.google.com/p/chromium/issues/detail?id=399951http://googlechromereleases.blogspot.com/2015/01/stable-update.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0093.htmlhttp://secunia.com/advisories/62383http://secunia.com/advisories/62665http://security.gentoo.org/glsa/glsa-201502-13.xmlhttp://www.securityfocus.com/bid/72288http://www.securitytracker.com/id/1031623https://code.google.com/p/chromium/issues/detail?id=399951
2015-01-22
Published