CVE-2013-6657
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0...
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
- Record
CVE-2013-6657- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
- Record
CVE-2013-6657- Updated
- 2026-11-02
EUVDEUVD-2013-6459 No score
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
- Record
EUVD-2013-6459- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h89f-7xhx-wfx9 No score
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0...
core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
- Record
GHSA-h89f-7xhx-wfx9- Updated
- 2026-11-02
OSVMGASA-2014-0107 No score
Updated chromium-browser-stable packages address multiple vulnerabilities
Use-after-free related to web contents (CVE-2013-6653).
Bad cast in SVG (CVE-2013-6654).
Use-after-free in layout (CVE-2013-6655).
Information leaks in XSS auditor (CVE-2013-6656, CVE-2013-6657).
Use-after-free in layout (CVE-2013-6658).
Issue with certificates validation in TLS handshake (CVE-2013-6659).
Information leak in drag and drop (CVE-2013-6660).
Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers (CVE-2013-6661).
- Record
MGASA-2014-0107- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 From an advisory covering 23 CVEs |
before 33.0.1750.152-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 26 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-329.0.1547.57-129.0.1547.57-1~deb7u129.0.1547.57-229.0.1547.57-329.0.1547.57-3+exp130.0.1599.101-130.0.1599.101-1~deb7u130.0.1599.101-230.0.1599.101-331.0.1650.57-131.0.1650.57-1~deb7u131.0.1650.63-131.0.1650.63-1~deb7u132.0.1700.123-132.0.1700.123-1~deb7u132.0.1700.123-232.0.1700.123-332.0.1700.123-4 |
33.0.1750.152-1~deb7u1 |
chromium-browser-stableMageia:3 From an advisory covering 9 CVEs |
before 33.0.1750.117-1.mga3 | 33.0.1750.117-1.mga3 |
chromium-browser-stableMageia:3 From an advisory covering 9 CVEs |
before 33.0.1750.117-1.mga3.tainted | 33.0.1750.117-1.mga3.tainted |
chromium-browser-stableMageia:4 From an advisory covering 9 CVEs |
before 33.0.1750.117-1.mga4 | 33.0.1750.117-1.mga4 |
chromium-browser-stableMageia:4 From an advisory covering 9 CVEs |
before 33.0.1750.117-1.mga4.tainted | 33.0.1750.117-1.mga4.tainted |
chromiumopenSUSE:Tumbleweed From an advisory covering 719 CVEs |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6657 is a medium vulnerability (CVSS 6.4) in Google Chrome, published February 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. No source names a fixed version.
References
debian.org/security/2014/dsa-2883
src.chromium.org/viewvc/blink?revision=164538&view=revision
lists.opensuse.org/opensuse-updates/2014-03/msg00006.html
googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html
code.google.com/p/chromium/issues/detail?id=331060
nvd.nist.gov/vuln/detail/CVE-2013-6657
Show 194 moreShow less
github.com/advisories/GHSA-h89f-7xhx-wfx9
advisories.mageia.org/MGASA-2014-0107.html
bugs.mageia.org/show_bug.cgi?id=12885
suse.com/security/cve/CVE-2011-3015
Left out here: 2,141 references. The JSON record has them.