CVE-2013-2835 Security feature bypass in n/a
Remote attackers can bypass domain-whitelist protections in Chrome OS plug-ins by visiting a crafted website, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-2835?
CVE-2013-2835 is a medium-severity vulnerability in Google Chrome Os, published on 16 Apr 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to bypass the domain-whitelist protection mechanism via a crafted web site, a different vulnerability than CVE-2013-2834.
Weakness: CWE-264
Which versions are affected by CVE-2013-2835?
It affects 1 product.
Products include Google Chrome Os.
How do I fix CVE-2013-2835?
No fix has been published for CVE-2013-2835 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-2835 being exploited?
There is no known exploitation of CVE-2013-2835 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome Os
Sources
Also known as GHSA-4m4m-6w8x-jm7p.