XSS in Google Chrome
CVE-2014-1701
The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.012 (64.7th percentile) — read the EPSS interpretation.
Affected products
- Google Chrome — versions 33.0.1750.0, 33.0.1750.1, 33.0.1750.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_DEBIAN)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_GENTOO)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vdb-entry, x_refsource_SECTRACK)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2014-1701?
- CVE-2014-1701 is a vulnerability in Google Chrome, classified under Cross-site Scripting. Published 2014-03-16.
- Is CVE-2014-1701 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.