CVE-2010-0651

MEDIUM 4.3CVE-2010-0651 · Published 18/02/2010 · updated 16/06/2026

In short

CVE-2010-0651 is a MEDIUM (CVSS 4.3) vulnerability affecting safari (apple), webkit (apple), chrome (google).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
safari apple	`≤ 4.0.4`	No fix yet
webkit apple	`≤ r53524`	No fix yet
chrome google	`≤ 4.0.249.78`	No fix yet

Description

WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.

References

code.google.com/p/chromium/issues/detail · Third Party Advisory
googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html · Patch
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Third Party Advisory
scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html · Third Party Advisory
secunia.com/advisories/41856 · Permissions Required
secunia.com/advisories/43068 · Permissions Required
securitytracker.com/id · Third Party Advisory
sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs · Third Party Advisory
trac.webkit.org/changeset/52784 · Vendor Advisory
websec.sv.cmu.edu/css/css.pdf · Third Party Advisory
mandriva.com/security/advisories

More vulnerabilities in safari

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

safari

apple

≤ 4.0.4

No fix yet

webkit

apple

≤ r53524

No fix yet

chrome

google

≤ 4.0.249.78

No fix yet

Description

More vulnerabilities in safari

See all →