CVE-2011-3956: Google Chrome

Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.

Affected products

• Google Chrome: before 17.0.963.46 (fixed in 17.0.963.46)

Published 2012-02-09. Last modified 2026-06-16.