CVE-2014-1701: Google Chrome

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.

Affected products

• Google Chrome: up to and including 33.0.1750.146; version 33.0.1750.0 only; version 33.0.1750.1 only; version 33.0.1750.2 only; version 33.0.1750.3 only; version 33.0.1750.4 only; …

Published 2014-03-16. Last modified 2026-06-17.