CVE-2009-3264: Google Chrome

Medium severity, CVSS 4.3. EPSS: 3.5% chance of exploitation in the next 30 days.

The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Policy and conduct cross-site scripting attacks via unknown vectors, related to a user's visit to a different web server that hosts an SVG document.

Affected products

• Google Chrome: up to and including 3.0.193.2; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2009-09-18. Last modified 2026-06-16.