CVE-2010-0661

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-18 · updated 2026-06-16
Weakness: CWE-264

Description

WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.

Affected products

Apple Webkit: 52400
Google Chrome: through 4.0.249.0; 0.2.149.27, 0.2.149.29, 0.2.149.30, 0.2.152.1, 0.2.153.1, 0.3.154.0 (+41)

References

http://code.google.com/p/chromium/issues/detail?id=30660
http://flock.com/security/
http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/43068
http://securitytracker.com/id?1023506
http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
http://trac.webkit.org/changeset/52401
http://www.vupen.com/english/advisories/2011/0212
https://bugs.webkit.org/show_bug.cgi?id=32647
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14482
http://code.google.com/p/chromium/issues/detail?id=30660

Get alerted when CVE-2010-0661 or the next vulnerability affects your stack