Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• google chromeup to 4.1.249.1058 inclusive
• google chrome1.0.154.53
• google chrome1.0.154.59
• google chrome1.0.154.64
• google chrome1.0.154.65
• google chrome2.0.169.0
• google chrome2.0.169.1
• google chrome2.0.170.0
• google chrome2.0.172.2
• google chrome2.0.172.27
• google chrome2.0.172.28
• google chrome2.0.172.30
• google chrome2.0.172.33
• google chrome2.0.172.37
• google chrome2.0.172.38
• google chrome2.0.172.8
• google chrome3.0.182.2
• google chrome3.0.195.2
• google chrome3.0.195.21
• google chrome3.0.195.24

Other highest-scoring records for the same primary product.

• CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boKEV
  95Now
• CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftKEV
  90Now
• CVE-2018-17463Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sKEV
  90Now
• CVE-2020-6418Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted KEV
  89Now
• CVE-2022-2294Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption viaKEV
  86Now
• CVE-2021-21220Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heKEV
  86Now

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.