CVE-2013-6634: Google Chrome

Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days.

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.

Affected products

• Google Chrome: up to and including 31.0.1650.62; version 31.0.1650.0 only; version 31.0.1650.2 only; version 31.0.1650.3 only; version 31.0.1650.4 only; version 31.0.1650.5 only; …

Published 2013-12-07. Last modified 2026-06-17.