‹ Back to list

CVE-2009-2578

Status: ModifiedMedium (5)—
Severity5Medium · CVSS 2.0
Exploitation probability0.82 %higher than 57% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.

CVSS

Base score
5
Version
2.0
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.82 %
Percentile among all scored CVEs
57
Score date
10/23/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Google — Chrome

CWEs

References

Show 4 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-2578",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-22T18:30:00.530",
  "references": [
    {
      "url": "http://websecurity.com.ua/3338/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/505092/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://websecurity.com.ua/3338/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/505092/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479."
    },
    {
      "lang": "es",
      "value": "Google Chrome v2.x a 2.0.172 permite a atacantes remotos causar una denegación de servicios (caída de aplicación)a través de un argumento de cadena de caracteres Unicode larga para el método de escritura, siendo un asunto relacionado con CVE-2009-2479."
    }
  ],
  "lastModified": "2026-06-16T23:09:44.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.156.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2F95770-F36F-43C0-986F-5C819648271E"
            },
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.157.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECCE1FD3-8D27-4304-97F9-6F9689F2498D"
            },
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.157.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F6CA696-49AA-4445-B978-96C1D8CE58DF"
            },
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.158.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CFA3BF-6C07-448B-8C83-AD4C524A6577"
            },
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.159.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8497F93-D88A-4FFA-B988-7210608530A8"
            },
            {
              "criteria": "cpe:2.3:a:google:chrome:2.0.172:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5CDF938-2998-403F-B343-29B620E05D44"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}