CVE-2009-2973: Google Chrome

Medium severity, CVSS 6.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the (1) MD2 or (2) MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409.

Affected products

• Google Chrome: up to and including 2.0.172.37; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2009-08-27. Last modified 2026-06-16.