CVE-2013-2493

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.12%

Published

Mar 7, 2013

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Hook_Terminate function in chrome_frame/protocol_sink_wrap.cc in the Google Chrome Frame plugin before 26.0.1410.28 for Internet Explorer does not properly handle attach tab requests, which allows user-assisted remote attackers to cause a denial of service (application crash) via an _blank value for the target attribute of an A element.

Weaknesses (CWE)

CWE-119

Affected Products (3)

google · chrome_framevulnerable

References (10)

http://googlechromereleases.blogspot.com/2013/03/beta-channel-update.html

http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/protocol_sink_wrap.cc?r1=185956&r2=185955&pathrev=185956

http://src.chromium.org/viewvc/chrome?view=rev&revision=185956

Vendor Advisory

https://chromiumcodereview.appspot.com/12395021

Vendor Advisory

https://code.google.com/p/chromium/issues/detail?id=178415