CVE-2013-2493: Google Chrome Frame

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

The Hook_Terminate function in chrome_frame/protocol_sink_wrap.cc in the Google Chrome Frame plugin before 26.0.1410.28 for Internet Explorer does not properly handle attach tab requests, which allows user-assisted remote attackers to cause a denial of service (application crash) via an _blank value for the target attribute of an A element.

Affected products

• Google Chrome Frame: up to and including 26.0.1410.27; version 15.0.874.121 only; version 16.0.912.63 only

Published 2013-03-07. Last modified 2026-06-16.