CVE-2014-1716
HighSummary
The XSS vulnerability in the Runtime_SetPrototype function in Google V8, used in Google Chrome before version 34.0.1847.116, allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
Risk Assessment
An attacker could exploit this vulnerability to take control of user sessions or steal data, posing a serious security threat to the organization.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Google V8 in Google Chrome
See all- CVE-2015-6771High
In Google V8, used in Google Chrome before version 47.0.2526.73, there is an improper implementation of certain map and filter operations for arrays, which may lead to denial of service (out-of-bounds memory access) or possibly other unspecified impacts via crafted JavaScript code.
- CVE-2015-1304High
The object-observe.js file in Google V8, used in Google Chrome before version 45.0.2454.101, does not properly restrict method calls on access-checked objects. This allows remote attackers to bypass the Same Origin Policy via observe or getNotifier calls.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."