CVE-2009-2352
Google Chrome <= 1.0.154.48 - Cross-Site Scripting via Refresh Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-2352. PoCs published by MustLive.
AI-analyzed exploit summary The exploit describes a cross-site scripting (XSS) vulnerability in Google Chrome 1.0.154.48 due to improper sanitization of user-supplied input. An attacker can craft a URL with a malicious JavaScript payload in the 'refresh' header to execute arbitrary script code in the context of the user's session.
Description
Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta are also affected.
Exploits (1)
The exploit describes a cross-site scripting (XSS) vulnerability in Google Chrome 1.0.154.48 due to improper sanitization of user-supplied input. An attacker can craft a URL with a malicious JavaScript payload in the 'refresh' header to execute arbitrary script code in the context of the user's session.