Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit to Atte Kettunen of OUSPG.

[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader. Credit to Google Chrome Security Team (Cris Neckar).

[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag and drop. Credit to Vsevolod Vlasov of the Chromium development community.

[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with pop-up windows in extensions. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[177410] Medium CVE-2013-0920: Use-after-free in extension bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[174943] High CVE-2013-0921: Ensure isolated web sites run in their own processes.

[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute-force attempts. Credit to 't3553r'.

[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety issues in the USB Apps API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[169632] Low CVE-2013-0924: Check an extension's permissions API usage again file permissions. Credit to Benjamin Kalman of the Chromium development community.

[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions without the tabs permissions. Credit to Michael Vrable of Google.

[112325] Medium CVE-2013-0926: Avoid pasting active tags in certain situations. Credit to Subho Halder, Aditya Gupta, and Dev Kar of xys3c (xysec.com).

The version of Google Chrome installed on the remote host is a version prior to 26.0.1410.43 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to 'Web Audio' and     the extension bookmarks API. (CVE-2013-0916,     CVE-2013-0920)

  - An out-of-bounds read error exists related to the URL     loader. (CVE-2013-0917)

  - An unspecified error exists related to 'drag and drop'     actions and the developer tools. (CVE-2013-0918)

  - An unspecified error exists related to website process     isolation. (CVE-2013-0921)

  - An error exists related to HTTP basic authentication     and brute-force attacks. (CVE-2013-0922)

  - A memory safety issue exists related to the 'USB Apps'     API. (CVE-2013-0923)

  - A permissions error exists related to extensions API     and file permissions. (CVE-2013-0924)

  - URLs can be leaked to extensions even if the extension     does not have the 'tabs' permission. (CVE-2013-0925)

  - An error exists related to 'active tags' and the paste     action that has unspecified impact. (CVE-2013-0926)

The version of Google Chrome installed on the remote host is a version prior to 26.0.1410.43 and is, therefore, affected by the following vulnerabilities :\n\n- Use-after-free errors exist related to 'Web Audio' and the extension bookmarks API. (CVE-2013-0916, CVE-2013-0920)\n- An out-of-bounds read error exists related to the URL loader. (CVE-2013-0917)\n- An unspecified error exists related to 'drag and drop' actions and the developer tools. (CVE-2013-0918)\n- An unspecified error exists related to website process isolation. (CVE-2013-0921)\n- An error exists related to HTTP basic authentication and brute force attacks. (CVE-2013-0922)\n- A memory safety issue exists related to the 'USB Apps' API. (CVE-2013-0923)\n- A permissions error exists related to extensions API and file permissions. (CVE-2013-0924)\n- URLs can be leaked to extensions even if the extension does not have the 'tabs' permission. (CVE-2013-0925)\n- An error exists related to 'active tags' and the paste action that has unspecified impact. (CVE-2013-0926)

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
65850	FreeBSD : chromium -- multiple vulnerabilities (bdd48858-9656-11e2-a9a8-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
65691	Google Chrome < 26.0.1410.43 Multiple Vulnerabilities	Nessus	Windows	high
800112	Google Chrome < 26.0.1410.43 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2013-0925

critical

Tenable Plugins

critical

high

high

high