CVE-2009-2974: Google Chrome

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

Google Chrome 1.0.154.65, 1.0.154.48, and earlier allows remote attackers to (1) cause a denial of service (application hang) via vectors involving a chromehtml: URI value for the document.location property or (2) cause a denial of service (application hang and CPU consumption) via vectors involving a series of function calls that set a chromehtml: URI value for the document.location property.

Affected products

• Google Chrome: up to and including 1.0.154.48; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2009-08-27. Last modified 2026-06-16.