CVE-2011-1691 json
The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit b…
published 2011-04-15 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1691
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222, as used in Google Chrome before 11.0.696.43 and other products, does not properly handle access to the (1) counterIncrement and (2) counterReset attributes of CSSStyleDeclaration data provided by a getComputedStyle method call, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code.
Patch / fix
- google chrome 11.0.696.43
Exploit prediction
1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- bugs.webkit.org https://bugs.webkit.org/show_bug.cgi?id=57266 referenced PoC, tagged "exploit" by a source, unverified
- code.google.com http://code.google.com/p/chromium/issues/detail?id=77665 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
bugs.webkit.org
/show_bug.cgi?id=57266
exploit, issue-tracking, patch, third-party-advisory
-
code.google.com
/p/chromium/issues/detail?id=77665
exploit, issue-tracking, patch, vendor-advisory
-
trac.webkit.org
/changeset/82222
patch
-
googlechromereleases.blogspot.com
/2011/04/beta-channel-update_12.html
vendor-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14365
vdb-entry, signature, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/66818
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2011-1691
- NVD CVE-2011-1691
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.