| Package | Affected versions | Patched versions |
|---|---|---|
| safari | < 4.0.4 | 4.0.4 |
| chrome | < 3.0.195.33 | 3.0.195.33 |
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free