CVE-2008-6512

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-03-24 · updated 2026-06-16

Description

Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin function by hosting an assumed-safe file type containing Google Gear commands on the target domain, then accessing that file from the attacking domain, whose response headers are not checked and cause the worker code to run in the target domain.

Affected products

Google Gears: through 0.5; 0.1, 0.2, 0.3, 0.4

References

http://blog.watchfire.com/wfblog/2008/12/breaking-google-gears-cross-origin-communication-model.html
http://code.google.com/apis/gears/upcoming/api_workerpool.html#cross_origin
http://lists.grok.org.uk/pipermail/full-disclosure/2008-December/066291.html
http://secunia.com/advisories/33062
http://www.securityfocus.com/bid/32698
https://exchange.xforce.ibmcloud.com/vulnerabilities/47173
http://blog.watchfire.com/wfblog/2008/12/breaking-google-gears-cross-origin-communication-model.html
http://code.google.com/apis/gears/upcoming/api_workerpool.html#cross_origin
http://lists.grok.org.uk/pipermail/full-disclosure/2008-December/066291.html
http://secunia.com/advisories/33062
http://www.securityfocus.com/bid/32698
https://exchange.xforce.ibmcloud.com/vulnerabilities/47173

Get alerted when CVE-2008-6512 or the next vulnerability affects your stack