CVE-2009-1413

Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout…

published April 24, 2009

CVSS
—
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScript code, and then modifying document.location to arrange for JavaScript execution in the context of an arbitrary web site. NOTE: this can be leveraged for a remote attack by exploiting a chromehtml: argument-injection vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00837 · 57.3th percentile
Published
2009-04-24T15:00Z
EPSS history
Timeline
  • 24 APR 15:00Z
    Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout…
    cvelistv5