The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
No history.
Information
Published : 2014-07-20 11:12
Updated : 2025-04-12 10:46
NVD link : CVE-2014-3160
Mitre link : CVE-2014-3160
CVE.ORG link : CVE-2014-3160
JSON object : View
Products Affected
debian
- debian_linux
- chrome
CWE
CWE-264
Permissions, Privileges, and Access Controls