CVE-2013-6636
google chrome: no CVSS score yet. EPSS 1.3% chance of exploitation in the next 30 days.
The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- google:chrome
References
- http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://secunia.com/advisories/56217