CVE-2009-3934: Google Chrome

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

The WebFrameLoaderClient::dispatchDidChangeLocationWithinPage function in src/webkit/glue/webframeloaderclient_impl.cc in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause a denial of service via a page-local link, related to an "empty redirect chain," as demonstrated by a message in Yahoo! Mail.

Affected products

• Google Chrome: up to and including 3.0.195.21; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2009-11-12. Last modified 2026-06-16.