CVE-2013-6657: Google Chrome

Medium severity, CVSS 6.4. EPSS: 1.2% chance of exploitation in the next 30 days.

core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.

Affected products

• Google Chrome: up to and including 33.0.1750.116; version 33.0.1750.0 only; version 33.0.1750.1 only; version 33.0.1750.2 only; version 33.0.1750.3 only; version 33.0.1750.4 only; …

Published 2014-02-24. Last modified 2026-06-17.