CVE-2013-6666: Google Chrome

Medium severity, CVSS 5.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB_Flash.Navigate operation, which might allow remote attackers to bypass intended CORS restrictions via an inappropriate header.

Affected products

• Google Chrome: up to and including 33.0.1750.144; version 33.0.1750.0 only; version 33.0.1750.1 only; version 33.0.1750.2 only; version 33.0.1750.3 only; version 33.0.1750.4 only; …

Published 2014-03-05. Last modified 2026-06-17.