CVE-2014-7939

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Jan 22, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-79407.5The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126, as used in GoogleCVE-2014-79415.0The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 useCVE-2014-79427.5The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which allows remote attackersCVE-2014-79435.0Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecifieCVE-2014-79445.0The sycc422_to_rgb function in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 40.0.2214.91, does not properlyCVE-2014-79455.0OpenJPEG before r2908, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-CVE-2014-79465.0The RenderTable::simplifiedNormalFlowLayout function in core/rendering/RenderTable.cpp in Blink, as used in Google Chrome before 40.0.2214.9CVE-2014-79475.0OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-CVE-2014-79484.3The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job.cc in Google Chrome before 40.CVE-2014-79514.6Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a directCVE-2014-79527.8The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code byCVE-2014-79537.0Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to exec
CVE-2014-7939: Medium severity, CVSS 4.3 | Vulnix