CVE-2013-2902
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used...
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
- Record
CVE-2013-2902- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
- Record
CVE-2013-2902- Updated
- 2026-11-02
EUVDEUVD-2013-2841 No score
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
- Record
EUVD-2013-2841- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g2xj-3jcv-jw82 No score
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used...
Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.
- Record
GHSA-g2xj-3jcv-jw82- Updated
- 2026-11-02
OSVMGASA-2013-0278 No score
Updated chromium-browser-stable package fix security vulnerabilities
The chrome 29 development team found various issues from internal fuzzing audits, and other studies (CVE-2013-2887).
Krystian Bigaj discovered a file handling path sanitization issue (CVE-2013-2900).
Alex Chapman discovered an integer overflow issue in ANGLE, the Almost Native Graphics Layer (CVE-2013-2901).
cloudfuzzer discovered a use-after-free issue in XSLT (CVE-2013-2902).
cloudfuzzer discovered a use-after-free issue in HTMLMediaElement (CVE-2013-2903).
cloudfuzzer discovered a use-after-free issue in XML document parsing (CVE-2013-2904).
Christian Jaeger discovered an information leak due to insufficient file permissions (CVE-2013-2905).
- Record
MGASA-2013-0278- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 From an advisory covering 7 CVEs |
before 29.0.1547.57-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 8 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-3 |
29.0.1547.57-1~deb7u1 |
chromium-browser-stableMageia:2 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga2 | 29.0.1547.65-1.mga2 |
chromium-browser-stableMageia:3 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga3 | 29.0.1547.65-1.mga3 |
chromium-browser-stableMageia:3 From an advisory covering 7 CVEs |
before 29.0.1547.65-1.mga3.tainted | 29.0.1547.65-1.mga3.tainted |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2902 is a high vulnerability (CVSS 7.5) in Google Chrome, published August 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. No source names a fixed version.
