What is CVE-2010-4577?

CVE-2010-4577 is a high-severity vulnerability in Google Chrome, classified under Out-of-bounds Read. CVSS score: 7.5/10. Published 2010-12-22.

How severe is CVE-2010-4577?

High severity. CVSS v3 base score is 7.5 out of 10.

Out-of-bounds Read in Google Chrome

CVE-2010-4577

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."

Vulnerability class: Buffer Overflow

Published 2010-12-22 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.022 (81.9th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000

Affected products

Weakness classification (CWE)

References

lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html (vendor-advisory, Mailing List, Third Party Advisory)
googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html (Release Notes)
secunia.com/advisories/42648 (Third Party Advisory, Broken Link, third-party-advisory)
bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
www.vupen.com/english/advisories/2011/0216 (Third Party Advisory, vdb-entry, Broken Link)
bugs.webkit.org/show_bug.cgi (Permissions Required)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:13953 (Broken Link, signature, Third Party Advisory, vdb-entry)
secunia.com/advisories/43086 (Third Party Advisory, Broken Link, third-party-advisory)
code.google.com/p/chromium/issues/detail (Exploit, Mailing List, Issue Tracking)
www.redhat.com/support/errata/RHSA-2011-0177.html (vendor-advisory, Third Party Advisory, Broken Link)

Frequently asked questions

What is CVE-2010-4577?: CVE-2010-4577 is a high-severity vulnerability in Google Chrome, classified under Out-of-bounds Read. CVSS score: 7.5/10. Published 2010-12-22.
How severe is CVE-2010-4577?: High severity. CVSS v3 base score is 7.5 out of 10.