CVE-2009-3263
Estado: ModificadaMedia (4.3)—
Gravedad4.3Media · CVSS 2.0
Probabilidad de explotación1.39 %mayor que el 72 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Google Chrome 2.x y 3.x anteriores a 3.0.195.21 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de feeds (1) RSS o (2) Atom, relacionado con el renderizado de un contenido del tipo application/rss+xml como "contenido activo" XML.
CVSS
- Puntuación base
- 4.3
- Versión
- 2.0
- Vector
- AV:N/AC:M/Au:N/C:N/I:P/A:N
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 1.39 %
- Percentil entre todas las CVEs puntuadas
- 72
- Fecha de la puntuación
- 23/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
Mostrar las 12 referencias
- http://code.google.com/p/chromium/issues/detail?id=21238
- http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html
- http://secunia.com/advisories/36770
- http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/
- http://www.securityfocus.com/archive/1/506517/100/0/threaded
- http://www.securityfocus.com/bid/36416
- http://code.google.com/p/chromium/issues/detail?id=21238
- http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html
- http://secunia.com/advisories/36770
- http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/
- http://www.securityfocus.com/archive/1/506517/100/0/threaded
- http://www.securityfocus.com/bid/36416
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-3263",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-09-18T22:30:00.563",
"references": [
{
"url": "http://code.google.com/p/chromium/issues/detail?id=21238",
"source": "cve@mitre.org"
},
{
"url": "http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/36770",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/506517/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/36416",
"source": "cve@mitre.org"
},
{
"url": "http://code.google.com/p/chromium/issues/detail?id=21238",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/36770",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/506517/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/36416",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as XML \"active content.\""
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Google Chrome 2.x y 3.x anteriores a 3.0.195.21 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de feeds (1) RSS o (2) Atom, relacionado con el renderizado de un contenido del tipo application/rss+xml como \"contenido activo\" XML."
}
],
"lastModified": "2026-06-16T23:11:15.680",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:2.0.156.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2F95770-F36F-43C0-986F-5C819648271E"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.157.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ECCE1FD3-8D27-4304-97F9-6F9689F2498D"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.157.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F6CA696-49AA-4445-B978-96C1D8CE58DF"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.158.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9CFA3BF-6C07-448B-8C83-AD4C524A6577"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.159.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8497F93-D88A-4FFA-B988-7210608530A8"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49FB50A3-FFDA-4BB9-A2C1-DA6DACC2DAAB"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59F93BC8-FE87-4CEC-B28A-4B0B5A468EDE"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02D459C7-2555-42FA-9C68-619E410D7CBA"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5CDF938-2998-403F-B343-29B620E05D44"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64F89EA6-B411-4887-90A1-FF3A054424F6"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10D2BA3B-1C69-470C-9C40-001FAE82DDB4"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3583995C-CD74-401F-905D-65B73CFC4595"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0A621B1-3186-4CE2-8BCC-916027CC74CF"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4A9B50D-5B0F-41C9-8FAF-B78CD21A0554"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.31:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F5223F1-85CD-4DF9-9665-BDF7B554A784"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DD7AFBA-A9A2-4EE9-B652-78D25EFBB690"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B9D6ED9-D5C5-4CA9-84EA-8007F48CF597"
},
{
"criteria": "cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E7F7897-ECD1-499E-81CD-E224241B6607"
},
{
"criteria": "cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7422307-271F-4953-9CA4-C50238D27BAE"
},
{
"criteria": "cpe:2.3:a:google:chrome:3.0.190.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DCC3490-5B06-4992-8E31-CA46E18607B7"
},
{
"criteria": "cpe:2.3:a:google:chrome:3.0.193.2:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2F85551-EDB5-4790-8095-EFFA7DEC7F98"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org",
"evaluatorSolution": "Per http://www.securityfocus.com/archive/1/archive/1/506517/100/0/threaded\r\n\r\n\r\nVII. SOLUTION\r\n-------------------------\r\nChrome: Upgrade to latest version of Google Chrome (v3.0.195.21 or higher).\r\nIf you remain connected to the internet, this should be automatic.\r\nOpera: Wait for upcoming patch for Scenario (3) in next minor release\r\n(non-alpha/beta) of Opera 10 [Opera 9 users need to upgrade]. However, you\r\nwill still continue to be vulnerable to script execution."
}