CVE-2010-0661: Apple Webkit

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.

Affected products

• Apple Webkit: version 52400 only
• Google Chrome: up to and including 4.0.249.0; version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; …

Published 2010-02-18. Last modified 2026-06-16.