CVE-2011-3956

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-346

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 9, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-39577.5Use-after-free vulnerability in the garbage-collection functionality in Google Chrome before 17.0.963.46 allows remote attackers to cause a CVE-2011-39586.8Google Chrome before 17.0.963.46 does not properly perform casts of variables during handling of a column span, which allows remote attackerCVE-2011-39597.5Buffer overflow in the locale implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or posCVE-2011-39604.3Google Chrome before 17.0.963.46 does not properly decode audio data, which allows remote attackers to cause a denial of service (out-of-bouCVE-2011-39619.3Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a uCVE-2011-39624.3Google Chrome before 17.0.963.46 does not properly perform path clipping, which allows remote attackers to cause a denial of service (out-ofCVE-2011-39635.0Google Chrome before 17.0.963.46 does not properly handle PDF FAX images, which allows remote attackers to cause a denial of service (out-ofCVE-2011-39645.8Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof CVE-2011-39655.0Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (applicationCVE-2011-39667.5Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspeCVE-2011-39675.0Unspecified vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via aCVE-2011-39684.3Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspe
CVE-2011-3956: Medium severity, CVSS 6.8 | Vulnix