Unscored severity · published Nov 15, 2012
CVE-2012-5851
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which…
–
CVSS
2.3%
EPSS
No
On KEV
Description
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
through 22.0.1229.96; 22.0.1229.0; 22.0.1229.1; 22.0.1229.2; 22.0.1229.3; 22.0.1229.4; +34 more · source: NVD
SA
Safari · Apple
5.1.7 · source: NVD
WE
Webkit · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5851
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5851
Exploit
http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html
Exploit
https://bugs.webkit.org/show_bug.cgi?id=92692
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/80072
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability