CVE-2011-3046: Apple iPhone OS

High severity, CVSS 10.0. EPSS: 4.8% chance of exploitation in the next 30 days.

The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

Affected products

• Apple iPhone OS: before 5.1.1 (fixed in 5.1.1)
• Apple Safari: before 5.1.7 (fixed in 5.1.7)
• Google Chrome: before 17.0.963.78 (fixed in 17.0.963.78)
• Opensuse Opensuse: version 12.1 only

Published 2012-03-09. Last modified 2026-06-16.