Unscored severity · published Dec 7, 2011
CVE-2011-4692
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it…
–
CVSS
1.2%
EPSS
No
On KEV
Description
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
through 15 · source: NVD
SA
Safari · Apple
through 5.1.1 · source: NVD
WE
Webkit · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4692
Exploit
http://lcamtuf.coredump.cx/cachetime/
Exploit
http://oxplot.github.com/visipisi/visipisi.html
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14098
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability