What is CVE-2014-7939?

CVE-2014-7939 is a vulnerability in Chromium, classified under CWE-264. Published 2015-01-22.

Is CVE-2014-7939 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Chromium

CVE-2014-7939

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.

Published 2015-01-22 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.025 (84.1th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000

Affected products

Chromium — versions 40.0.2214.110
Google Chrome
openSUSE — versions 13.1, 13.2
Red Hat Enterprise Linux Desktop Supplementary — versions 6.0
Red Hat Enterprise Linux Server Supplementary — versions 6.0
Red Hat Enterprise Linux Server Supplementary Eus — versions 6.6.z
Red Hat Enterprise Linux Workstation Supplementary — versions 6.0

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

jesusprubio/strong-node

References

secunia.com/advisories/62665 (third-party-advisory)
googlechromereleases.blogspot.com/2015/01/stable-update.html
www.securityfocus.com/bid/72288 (vdb-entry)
security.gentoo.org/glsa/glsa-201502-13.xml (vendor-advisory)
www.securitytracker.com/id/1031623 (vdb-entry)
lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html (vendor-advisory)
rhn.redhat.com/errata/RHSA-2015-0093.html (vendor-advisory)
secunia.com/advisories/62383 (third-party-advisory)
code.google.com/p/chromium/issues/detail

Frequently asked questions

What is CVE-2014-7939?: CVE-2014-7939 is a vulnerability in Chromium, classified under CWE-264. Published 2015-01-22.
Is CVE-2014-7939 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.