CVE-2011-1190

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-03-11 · updated 2026-06-16
Weakness: CWE-200

Description

The Web Workers implementation in Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

Affected products

Apple Iphone Os: before 5.0 — fixed in 5.0
Apple Safari: before 5.0.6 — fixed in 5.0.6
Google Chrome: before 10.0.648.127 — fixed in 10.0.648.127

How to fix

Upgrade to a fixed version: Apple Iphone Os 5.0; Apple Safari 5.0.6; Google Chrome 10.0.648.127. Check the vendor advisory for mitigations.

References

http://code.google.com/p/chromium/issues/detail?id=70336
http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
http://support.apple.com/kb/HT4808
http://support.apple.com/kb/HT4999
http://www.securityfocus.com/bid/46785
http://www.vupen.com/english/advisories/2011/0628
https://exchange.xforce.ibmcloud.com/vulnerabilities/65954
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14398
http://code.google.com/p/chromium/issues/detail?id=70336
http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html

Get alerted when CVE-2011-1190 or the next vulnerability affects your stack