CVE-2014-1716

Google Chrome < 34.0.1847.116 - Universal Cross-Site Scripting via Runtime_SetPrototype

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

References (6)

Core 6
Core References
Issue Tracking x_refsource_confirm
https://code.google.com/p/v8/source/detail?r=20138
Release Notes, Vendor Advisory x_refsource_confirm
http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-05/msg00012.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201408-16.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2905

Scores

EPSS 0.0193
EPSS Percentile 77.6%

Details

CWE
CWE-94
Status published
Products (5)
debian/debian_linux 7.0
debian/debian_linux 8.0
google/chrome < 34.0.1847.115
opensuse/opensuse 12.3
opensuse/opensuse 13.1
Published Apr 09, 2014
Tracked Since Feb 18, 2026