CVE-2014-3160

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-20 · updated 2026-06-17
Weakness: CWE-264

Description

The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.

Affected products

Debian Linux: 7.0, 8.0
Google Chrome: 36.0.1985.1, 36.0.1985.2, 36.0.1985.3, 36.0.1985.4, 36.0.1985.5, 36.0.1985.6 (+97)

References

http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
http://secunia.com/advisories/60061
http://secunia.com/advisories/60372
http://security.gentoo.org/glsa/glsa-201408-16.xml
http://www.debian.org/security/2014/dsa-3039
http://www.securityfocus.com/bid/68677
https://code.google.com/p/chromium/issues/detail?id=380885
https://src.chromium.org/viewvc/blink?revision=176084&view=revision
http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
http://secunia.com/advisories/60061
http://secunia.com/advisories/60372
http://security.gentoo.org/glsa/glsa-201408-16.xml

Get alerted when CVE-2014-3160 or the next vulnerability affects your stack