kbrain

CVE-2009-1413

MEDIUM · CVSS 4.3EPSS 0.8%EU EUVD

Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScript code, and then modifying document.location to arrange for JavaScript execution in the context of an arbitrary web site. NOTE: this can be leveraged for a remote attack by exploiting a chromehtml: argument-injection vulnerability.

Key facts

CVSS score
4.3 (v2.0)
Severity
MEDIUM
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness (CWE)
CWE-264
EPSS score
0.8% (58th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2009-1411)
Published
April 24, 2009
NVD last modified
June 16, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1411 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

  • google / chrome
  • google / chrome
  • google / chrome
  • google / chrome
  • google / chrome
  • google / chrome
  • google / chrome

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain