Definition

Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding escaping and quoting for the URL in the --app argument in a desktop shortcut which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.

oval:org.mitre.oval:def:14306

Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding escaping and quoting for the URL in the --app argument in a desktop shortcut which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.

Family:

windows

Status:

ACCEPTED

Platform(s):

Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000

Class:

vulnerability

Reference(s):

CVE-2010-0657

Product(s):

Google Chrome