CVE-2010-2297: google chrome Code Injection

Vulnerability summary

CVE-2010-2297 is a high (CVSS 9.3) Code Injection vulnerability in google chrome. EPSS estimates a 2.81% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities.

Timeline

1. 15-06-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

rendering/FixedTableLayout.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an HTML document that has a large colspan attribute within a table.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.