Description
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | chromium-browser | 37.0.2062.120-1~deb7u1 | DSA-3039-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | chromium-browser | 37.0.2062.94-0ubuntu0.14.04.1~pkg1042 | — |
| Ubuntu 14.04 LTS | oxide-qt | 1.0.5-0ubuntu0.14.04.1 | USN-2320-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 | openSUSE-SU-2024:12948-1, openSUSE-SU-2024:10171-1 |
Advisories 4
- DSA-3039-1 chromium-browser - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2320-1 oxide-qt vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10171-1 chromedriver-55.0.2883.75-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12948-1 ungoogled-chromium-113.0.5672.92-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://src.chromium.org/viewvc/chrome?revision=286598&view=revision
- 59693 third-party-advisory
- [tls] 20140810 Re: Inter-protocol attacks mailing-list
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
- 59904 third-party-advisory
- 60685 third-party-advisory
- https://src.chromium.org/viewvc/chrome?revision=288435&view=revision
- GLSA-201408-16 vendor-advisory
- 60798 third-party-advisory
- https://code.google.com/p/chromium/issues/detail?id=398925
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- 69202 vdb-entry
- DSA-3039 vendor-advisory
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html
- 1030732 vdb-entry