CVE-2009-1412: Infoleak
First published: Fri Apr 24 2009(Updated: )
Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, allows remote attackers to determine the existence of files, and open tabs for URLs that do not satisfy the IsWebSafeScheme restriction, via a web page that sets document.location to a chromehtml: value, as demonstrated by use of a (1) javascript: or (2) data: URL. NOTE: this can be leveraged for Universal XSS by exploiting certain behavior involving persistence across page transitions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Chrome (Trace Event) | <=1.0.154.53 | |
| Google Chrome (Trace Event) | =0.2.149.29 | |
| Google Chrome (Trace Event) | =0.2.149.30 | |
| Google Chrome (Trace Event) | =0.2.152.1 | |
| Google Chrome (Trace Event) | =0.2.153.1 | |
| Google Chrome (Trace Event) | =0.3.154.0 | |
| Google Chrome (Trace Event) | =0.3.154.3 | |
| Google Chrome (Trace Event) | =0.4.154.18 | |
| Google Chrome (Trace Event) | =0.4.154.22 | |
| Google Chrome (Trace Event) | =0.4.154.31 | |
| Google Chrome (Trace Event) | =0.4.154.33 | |
| Google Chrome (Trace Event) | =1.0.154.36 | |
| Google Chrome (Trace Event) | =1.0.154.39 | |
| Google Chrome (Trace Event) | =1.0.154.42 | |
| Google Chrome (Trace Event) | =1.0.154.43 | |
| Google Chrome (Trace Event) | =1.0.154.46 | |
| Internet Explorer | =7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-1412?
CVE-2009-1412 is classified as a medium severity vulnerability.
How do I fix CVE-2009-1412?
To fix CVE-2009-1412, update Google Chrome to version 1.0.154.59 or later.
What types of attacks are possible with CVE-2009-1412?
CVE-2009-1412 allows attackers to determine the existence of files on the system and to bypass URL restrictions.
Which versions of Google Chrome are affected by CVE-2009-1412?
CVE-2009-1412 affects Google Chrome versions prior to 1.0.154.59, including versions 0.2.149.29 to 1.0.154.46.
Can Internet Explorer trigger the CVE-2009-1412 vulnerability?
Yes, CVE-2009-1412 can be triggered when Google Chrome is invoked by Internet Explorer.
- collector/nvd-historical
- agent/references
- agent/weakness
- agent/type
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/google
- canonical/google chrome (trace event)
- version/google chrome (trace event)/1.0.154.53
- version/google chrome (trace event)/0.2.149.29
- version/google chrome (trace event)/0.2.149.30
- version/google chrome (trace event)/0.2.152.1
- version/google chrome (trace event)/0.2.153.1
- version/google chrome (trace event)/0.3.154.0
- version/google chrome (trace event)/0.3.154.3
- version/google chrome (trace event)/0.4.154.18
- version/google chrome (trace event)/0.4.154.22
- version/google chrome (trace event)/0.4.154.31
- version/google chrome (trace event)/0.4.154.33
- version/google chrome (trace event)/1.0.154.36
- version/google chrome (trace event)/1.0.154.39
- version/google chrome (trace event)/1.0.154.42
- version/google chrome (trace event)/1.0.154.43
- version/google chrome (trace event)/1.0.154.46
- vendor/microsoft
- canonical/internet explorer
- version/internet explorer/7