Unscored severity · published Sep 7, 2010
CVE-2010-3259
WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images…
–
CVSS
1.6%
EPSS
No
On KEV
Description
WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
before 6.0.472.53 · source: NVD
IO
iOS · Apple
before 4.2 · source: NVD
SA
Safari · Apple
before 4.1.3; 5.0 before 5.0.3 · source: NVD
UL
Ubuntu Linux · Canonical
9.10; 10.04; 10.10 · source: NVD
WE
Webkitgtk · Webkitgtk
before 1.2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3259
Patch
http://code.google.com/p/chromium/issues/detail?id=53001
Vendor Advisory
http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html
Mailing List
http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html
Mailing List
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
Third Party Advisory
http://secunia.com/advisories/41856
More from iOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
9.8
CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability