Unscored severity · published Jan 22, 2015
CVE-2014-7939
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
through 40.0.2214.85 · source: NVD
CH
Chromium · Chromium
40.0.2214.110 · source: NVD
EL
Enterprise Linux Desktop Supplementary · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Supplementary · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Supplementary Eus · Redhat
6.6.z · source: NVD
EL
Enterprise Linux Workstation Supplementary · Redhat
6.0 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7939
googlechromereleases.blogspot.com
http://googlechromereleases.blogspot.com/2015/01/stable-update.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0093.html
secunia.com
http://secunia.com/advisories/62383
secunia.com
http://secunia.com/advisories/62665
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201502-13.xml
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability