CVE-2013-6660: Google Chrome

Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days.

The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures, which allows remote attackers to discover full pathnames via a crafted web site.

Affected products

• Google Chrome: up to and including 33.0.1750.116; version 33.0.1750.0 only; version 33.0.1750.1 only; version 33.0.1750.2 only; version 33.0.1750.3 only; version 33.0.1750.4 only; …

Published 2014-02-24. Last modified 2026-06-17.