CVE-2010-0659: Apple Webkit

High severity, CVSS 9.3. EPSS: 3.2% chance of exploitation in the next 30 days.

The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.

Affected products

• Apple Webkit: up to and including r53524
• Google Chrome: up to and including 4.0.249.78; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2010-02-18. Last modified 2026-06-16.