The Google URL Parsing Library (aka google-url or GURL) in Google Chrome before 4.1.249.1064 allows remote attackers to bypass the Same Ori…

published 2010-04-30 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-1684

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 54.1%; EPSS 54.1% chance of exploitation in 30 days, percentile 99%
public exploits: 1; Exploit-DB

The Google URL Parsing Library (aka google-url or GURL) in Google Chrome before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

Patch / fix

fixed in 1

google chrome 4.1.249.1064

Timeline

2010-04-30 Published
2010-05-19 First public exploit (EDB-12657)

Exploit prediction

54.07% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-12657 Google Chrome 4.1.249.1059 - Cross Origin Bypass in Google URL (GURL) remote, 2010-05-19
bugs.chromium.org http://bugs.chromium.org/40445 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

Technology feeds

Google Chrome rss critical rss

References

bugs.chromium.org /40445
exploit
secunia.com /advisories/39651
third-party-advisory, vendor-advisory
vupen.com /english/advisories/2010/1016
vdb-entry, vendor-advisory
googlechromereleases.blogspot.com /2010/04/stable-update-bug-and-security-fixes.html
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6813
vdb-entry, signature

Sources

CVE List CVE-2010-1663
NVD CVE-2010-1663

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Consolidate version ranges.

Summary