NetSight
IP …
medium5.8

CVE-2013-6666

The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that al…

Impact

The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB_Flash.Navigate operation, which might allow remote attackers to bypass intended CORS restrictions via an inappropriate header.

Affected products

VendorProductAffected versions
GoogleChrome
through 33.0.1750.144
Versions 33.0.1750.0, 33.0.1750.1, 33.0.1750.2, 33.0.1750.3, 33.0.1750.4

Weakness classification

CWE-264

References