CVE-2013-2871

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to...

7.5 High

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.

Exploit likelihood

1.70%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2013-2871
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2871
Updated: 2026-11-02

EUVDEUVD-2013-2810 No score

Record: EUVD-2013-2810
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qgxf-wq7g-32jh No score

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to...

Record: GHSA-qgxf-wq7g-32jh
Weakness: CWE-20
Updated: 2026-11-02

OSVMGASA-2013-0234 No score

Updated chromium-browser-stable packages fix security vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities:

The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline) (CVE-2013-2853).

Chrome does not properly prevent pop-under windows (CVE-2013-2867).

common/extensions/sync_helper.cc proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting (CVE-2013-2868).

Denial of service (out-of-bounds read) via a crafted JPEG2000 image (CVE-2013-2869).

Use-after-free vulnerability in network sockets (CVE-2013-2870).

Use-after-free vulnerability in input handling (CVE-2013-2871).

Use-after-free vulnerability in resource loading (CVE-2013-2873).

Out-of-bounds read in SVG file handling (CVE-2013-2875).

Chrome does not properly enforce restrictions on the capture of screenshots by extensions, which could lead to information disclosure from previous page visits (CVE-2013-2876).

Out-of-bounds read in text handling (CVE-2013-2878).

The circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations were not propertly checked (CVE-2013-2879).

The chrome 28 development team found various issues from internal fuzzing, audits, and other studies (CVE-2013-2880).

Record: MGASA-2013-0234
Updated: 2026-11-02

Affected products

google chrome

Affected packages

Affected packages
Package	Affected	Fixed
`chromium-browser` Debian:7 From an advisory covering 13 CVEs	before 28.0.1500.71-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-127.0.1453.93-1~deb7u1	28.0.1500.71-1~deb7u1
`chromium-browser-stable` Mageia:2 From an advisory covering 12 CVEs	before 28.0.1500.71-1.mga2	28.0.1500.71-1.mga2
`chromium-browser-stable` Mageia:3 From an advisory covering 12 CVEs	before 28.0.1500.71-1.mga3	28.0.1500.71-1.mga3
`chromium-browser-stable` Mageia:3 From an advisory covering 12 CVEs	before 28.0.1500.71-1.mga3.tainted	28.0.1500.71-1.mga3.tainted

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2871 is a high vulnerability (CVSS 7.5) in Google Chrome, published July 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. No source names a fixed version.

References

Show 7 moreShow less