CVE-2010-0657
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and...
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
Exploit likelihood
What each source reports
NVD Score used
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
- Record
CVE-2010-0657- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
- Record
CVE-2010-0657- Updated
- 2026-11-02
EUVDEUVD-2010-0688 No score
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
- Record
EUVD-2010-0688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvxv-9v6h-xhg5 No score
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and...
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
- Record
GHSA-hvxv-9v6h-xhg5- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0657 is a high vulnerability (CVSS 9.3) in Google Chrome, published February 18, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. No source names a fixed version.
References
googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14306
securitytracker.com/id?1023506
sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
code.google.com/p/chromium/issues/detail?id=23693
nvd.nist.gov/vuln/detail/CVE-2010-0657
github.com/advisories/GHSA-hvxv-9v6h-xhg5