Description
Google Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might allow remote attackers to bypass the Same Origin Policy via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | chromium-browser | 6.0.472.63~r59945-5+squeeze2 | DSA-2166-1 |
| Debian 6.0 | webkit | 1.2.7-0+squeeze1 | DSA-2188-1 |
Advisories 2
- DSA-2188-1 webkit - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2166-1 chromium-browser - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 43368 third-party-advisory
- SUSE-SR:2011:009 vendor-advisory
- oval:org.mitre.oval:def:14228 vdb-entry signature
- DSA-2166 vendor-advisory
- ADV-2011-0408 vdb-entry
- DSA-2188 vendor-advisory
- http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html
- http://code.google.com/p/chromium/issues/detail?id=59081