CVE-2011-3640: google chrome Untrusted Search Path
Vulnerability summary
CVE-2011-3640 is a high (CVSS 7.1) Untrusted Search Path vulnerability in google chrome. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 28-10-2011PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.40%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (blog.acrossecurity.com)
Maturity: unknown
Exploit Reference (code.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- nss< 3.12.8-1+squeeze4 | < 3.12.3.1-0lenny7 | < 3.13.1.with.ckbi.1.88-1
Google1 product
- chrome< 17.0
2 vendors · 2 products
References
8 links- securityreason.com/securityalert/8483Third Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414VDB EntrySignatureThird Party Advisory
- blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.htmlExploitThird Party Advisory
