CVE-2010-3115

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-08-24 · updated 2026-06-16

Description

Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not properly implement the history feature, which might allow remote attackers to spoof the address bar via unspecified vectors.

Affected products

Canonical Ubuntu Linux: 9.10, 10.04, 10.10
Google Chrome: before 5.0.375.127 — fixed in 5.0.375.127
Webkit: before 1.2.6 — fixed in 1.2.6

How to fix

Upgrade to a fixed version: Google Chrome 5.0.375.127; Webkit 1.2.6. Check the vendor advisory for mitigations.

References

http://code.google.com/p/chromium/issues/detail?id=49964
http://googlechromereleases.blogspot.com/2010/08/stable-channel-update_19.html
http://secunia.com/advisories/41856
http://secunia.com/advisories/43086
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
http://www.redhat.com/support/errata/RHSA-2011-0177.html
http://www.securityfocus.com/bid/44203
http://www.ubuntu.com/usn/USN-1006-1
http://www.vupen.com/english/advisories/2010/2722
http://www.vupen.com/english/advisories/2011/0216
http://www.vupen.com/english/advisories/2011/0552
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11953

Get alerted when CVE-2010-3115 or the next vulnerability affects your stack