CVE-2012-2889

Google Chrome < 22.0.1229.79 - Cross-Site Scripting via Frame Handling

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)."

References (8)

Core 8
Core References
Release Notes, Vendor Advisory x_refsource_confirm
http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5642
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15829
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78823
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.html

Scores

EPSS 0.0130
EPSS Percentile 67.5%

Details

CWE
CWE-79
Status published
Products (50)
apple/iphone_os 6.0
apple/iphone_os 6.0.1
apple/iphone_os < 6.0.2
google/chrome 22.0.1229.0
google/chrome 22.0.1229.1
google/chrome 22.0.1229.2
google/chrome 22.0.1229.3
google/chrome 22.0.1229.4
google/chrome 22.0.1229.6
google/chrome 22.0.1229.7
... and 40 more
Published Sep 26, 2012
Tracked Since Feb 18, 2026