CVE-2014-7939 Security feature bypass in n/a

Medium 4.3 Published 22 Jan 2015 Updated 6 Aug 2024

Remote attackers can bypass Same Origin Policy in Chrome via crafted JavaScript when the Harmony proxy is enabled, requiring user interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2014-7939?

CVE-2014-7939 is a medium-severity vulnerability in Google Chrome, published on 22 Jan 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.

Weakness: CWE-264

Which versions are affected by CVE-2014-7939?

It affects 7 products.

Products include Chromium Chromium, Google Chrome, Opensuse Opensuse, Redhat Enterprise Linux Desktop Supplementary, Redhat Enterprise Linux Server Supplementary, Redhat Enterprise Linux Server Supplementary Eus and 1 more.

How do I fix CVE-2014-7939?

Upgrade to a fixed version.

Is CVE-2014-7939 being exploited?

There is no known exploitation of CVE-2014-7939 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as GHSA-m956-r3pg-f666, UBUNTU-CVE-2014-7939.