CVE-2012-2899: XSS
Published Jan 5, 2014
·Updated
Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.
Affected Software
46 affected components
Google Chrome<=21.0.1180.81
Google Chrome=21.0.1180.0
Google Chrome=21.0.1180.1
Google Chrome=21.0.1180.2
Google Chrome=21.0.1180.31
Google Chrome=21.0.1180.32
Google Chrome=21.0.1180.33
Google Chrome=21.0.1180.34
Google Chrome=21.0.1180.35
Google Chrome=21.0.1180.36
Google Chrome=21.0.1180.37
Google Chrome=21.0.1180.38
Google Chrome=21.0.1180.39
Google Chrome=21.0.1180.41
Google Chrome=21.0.1180.46
Google Chrome=21.0.1180.47
Google Chrome=21.0.1180.48
Google Chrome=21.0.1180.49
Google Chrome=21.0.1180.50
Google Chrome=21.0.1180.51
Google Chrome=21.0.1180.52
Google Chrome=21.0.1180.53
Google Chrome=21.0.1180.54
Google Chrome=21.0.1180.55
Google Chrome=21.0.1180.56
Google Chrome=21.0.1180.57
Google Chrome=21.0.1180.59
Google Chrome=21.0.1180.60
Google Chrome=21.0.1180.61
Google Chrome=21.0.1180.62
Google Chrome=21.0.1180.63
Google Chrome=21.0.1180.64
Google Chrome=21.0.1180.68
Google Chrome=21.0.1180.69
Google Chrome=21.0.1180.70
Google Chrome=21.0.1180.71
Google Chrome=21.0.1180.72
Google Chrome=21.0.1180.73
Google Chrome=21.0.1180.74
Google Chrome=21.0.1180.75
Google Chrome=21.0.1180.76
Google Chrome=21.0.1180.77
Google Chrome=21.0.1180.78
Google Chrome=21.0.1180.79
Google Chrome=21.0.1180.80
Apple Ipad2
Event History
Jan 5, 2014
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2899?
CVE-2012-2899 is considered a high severity vulnerability due to its potential for Universal XSS attacks.
2
How do I fix CVE-2012-2899?
To fix CVE-2012-2899, update Google Chrome to version 21.0.1180.82 or later.
3
What vulnerability does CVE-2012-2899 exploit?
CVE-2012-2899 exploits incorrect calls to WebView methods that allow bypassing the Same Origin Policy.
4
Who is affected by CVE-2012-2899?
CVE-2012-2899 affects users of Google Chrome versions prior to 21.0.1180.82 on iOS.
5
What kind of attack can CVE-2012-2899 facilitate?
CVE-2012-2899 can facilitate Universal XSS (UXSS) attacks via the document.write method.