CVE-2010-1236
N/A
Published: April 1, 2010 at 10:00 PM UTC
Updated: June 16, 2026 at 11:17 PM UTC
2 products affected across 2 vendorsChromeFlock
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 1%
Description
The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \x00javascript:alert sequence.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≤ 4.1.249.10350.1.38.10.1.38.20.1.38.40.1.40.10.1.42.20.1.42.31.0.154.531.0.154.591.0.154.641.0.154.652.0.169.02.0.169.12.0.170.02.0.172.22.0.172.272.0.172.282.0.172.302.0.172.332.0.172.372.0.172.382.0.172.83.0.182.23.0.190.23.0.195.253.0.195.273.0.195.333.0.195.363.0.195.373.0.195.384.0.212.04.0.212.14.0.221.84.0.222.04.0.222.14.0.222.124.0.222.54.0.223.04.0.223.14.0.223.24.0.223.44.0.223.54.0.223.74.0.223.84.0.223.94.0.224.04.0.229.14.0.235.04.0.236.04.0.237.04.0.237.14.0.239.04.0.240.04.0.241.04.0.242.04.0.243.04.0.244.04.0.245.04.0.245.14.0.246.04.0.247.04.0.248.04.0.249.04.0.249.14.0.249.104.0.249.114.0.249.124.0.249.144.0.249.164.0.249.174.0.249.184.0.249.194.0.249.24.0.249.204.0.249.214.0.249.224.0.249.234.0.249.244.0.249.254.0.249.264.0.249.274.0.249.284.0.249.294.0.249.34.0.249.304.0.249.314.0.249.324.0.249.334.0.249.344.0.249.354.0.249.364.0.249.374.0.249.384.0.249.394.0.249.44.0.249.404.0.249.414.0.249.424.0.249.434.0.249.444.0.249.454.0.249.464.0.249.474.0.249.484.0.249.494.0.249.54.0.249.504.0.249.514.0.249.524.0.249.534.0.249.544.0.249.554.0.249.564.0.249.574.0.249.584.0.249.594.0.249.64.0.249.604.0.249.614.0.249.624.0.249.634.0.249.644.0.249.654.0.249.664.0.249.674.0.249.684.0.249.694.0.249.74.0.249.704.0.249.714.0.249.724.0.249.734.0.249.744.0.249.754.0.249.764.0.249.774.0.249.784.0.249.78 beta4.0.249.794.0.249.84.0.249.804.0.249.814.0.249.824.0.249.894.0.249.94.0.250.04.0.250.24.0.251.04.0.252.04.0.254.04.0.255.04.0.256.04.0.257.04.0.258.04.0.259.04.0.260.04.0.261.04.0.262.04.0.263.04.0.264.04.0.265.04.0.266.04.0.267.04.0.268.04.0.269.04.0.271.04.0.272.04.0.275.04.0.275.14.0.276.04.0.277.04.0.278.04.0.286.04.0.287.04.0.288.04.0.288.14.0.289.04.0.290.04.0.292.04.0.294.04.0.295.04.0.296.04.0.299.04.0.300.04.0.301.04.0.302.04.0.302.14.0.302.24.0.302.34.0.303.04.0.304.04.0.305.04.1.249.04.1.249.10014.1.249.10044.1.249.10064.1.249.10074.1.249.10084.1.249.10094.1.249.10104.1.249.10114.1.249.10124.1.249.10134.1.249.10144.1.249.10154.1.249.10164.1.249.10174.1.249.10184.1.249.10194.1.249.10204.1.249.10214.1.249.10224.1.249.10234.1.249.10244.1.249.10254.1.249.10264.1.249.10274.1.249.10284.1.249.10294.1.249.10304.1.249.10314.1.249.10324.1.249.10334.1.249.1034
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (10)
x_refsource_CONFIRMExploit
Source: [email protected]
http://code.google.com/p/chromium/issues/detail?id=37383x_refsource_CONFIRM
Source: [email protected]
http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlThird Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/43068x_refsource_CONFIRM
Source: [email protected]
http://src.chromium.org/viewvc/chrome?view=rev&revision=41244VDB Entryx_refsource_VUPENVendor Advisory
Source: [email protected]
http://www.vupen.com/english/advisories/2011/0212Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card