CVE-2010-4576

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

browser/worker_host/message_port_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 does not properly handle certain postMessage calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code that creates a web worker.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://code.google.com/p/chromium/issues/detail?id=63529Exploit, Patch, Vendor Advisory
http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.htmlVendor Advisory
http://secunia.com/advisories/42648Third Party Advisory
http://src.chromium.org/viewvc/chrome?view=rev&revision=66620Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-201012-01.xmlThird Party Advisory
http://www.securityfocus.com/bid/45390Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14161Third Party Advisory
http://code.google.com/p/chromium/issues/detail?id=63529Exploit, Patch, Vendor Advisory
http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.htmlVendor Advisory
http://secunia.com/advisories/42648Third Party Advisory
http://src.chromium.org/viewvc/chrome?view=rev&revision=66620Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-201012-01.xmlThird Party Advisory
http://www.securityfocus.com/bid/45390Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14161Third Party Advisory

Timeline

Published: Dec 22, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-45777.5The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befo CVE-2010-45787.5Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling, which allows remote attackers to CVE-2010-45795.0Opera before 11.00 does not properly constrain dialogs to appear on top of rendered documents, which makes it easier for remote attackers to CVE-2010-45805.0Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sen CVE-2010-458110.0Unspecified vulnerability in Opera before 11.00 has unknown impact and attack vectors, related to "a high severity issue."CVE-2010-45825.0Opera before 11.00 does not properly handle security policies during updates to extensions, which might allow remote attackers to bypass int CVE-2010-45832.6Opera before 11.00, when Opera Turbo is enabled, does not display a page's security indication, which makes it easier for remote attackers t CVE-2010-45842.6Opera before 11.00, when Opera Turbo is used, does not properly present information about problematic X.509 certificates on https web sites,CVE-2010-45855.0Unspecified vulnerability in the auto-update functionality in Opera before 11.00 allows remote attackers to cause a denial of service (appli CVE-2010-458610.0The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and remote attack vectors, po CVE-2010-45879.3Opera before 11.00 on Windows does not properly implement the Insecure Third Party Module warning message, which might make it easier for us CVE-2010-45889.3The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute