Description
The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | chromium-browser | 31.0.1650.63-1~deb7u1 | DSA-2811-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 | openSUSE-SU-2024:12948-1, openSUSE-SU-2024:10171-1 |
Advisories 3
- DSA-2811-1 chromium-browser - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10171-1 chromedriver-55.0.2883.75-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12948-1 ungoogled-chromium-113.0.5672.92-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 56217 third-party-advisory
- https://code.google.com/p/chromium/issues/detail?id=322959
- openSUSE-SU-2014:0065 vendor-advisory
- http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html
- openSUSE-SU-2013:1933 vendor-advisory
- DSA-2811 vendor-advisory
- openSUSE-SU-2013:1927 vendor-advisory
- https://src.chromium.org/viewvc/blink?revision=162673&view=revision
- 1029442 vdb-entry