CVE-2014-1747
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in...
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- Record
CVE-2014-1747- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- Record
CVE-2014-1747- Updated
- 2026-11-02
EUVDEUVD-2014-1821 No score
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- Record
EUVD-2014-1821- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2574-fqfw-fxcc No score
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in...
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- Record
GHSA-2574-fqfw-fxcc- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1747 No score
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- Record
UBUNTU-CVE-2014-1747- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 From an advisory covering 9 CVEs |
before 35.0.1916.114-1~deb7u2, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 38 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-329.0.1547.57-129.0.1547.57-1~deb7u129.0.1547.57-229.0.1547.57-329.0.1547.57-3+exp130.0.1599.101-130.0.1599.101-1~deb7u130.0.1599.101-230.0.1599.101-331.0.1650.57-131.0.1650.57-1~deb7u131.0.1650.63-131.0.1650.63-1~deb7u132.0.1700.123-132.0.1700.123-1~deb7u132.0.1700.123-232.0.1700.123-332.0.1700.123-433.0.1750.152-133.0.1750.152-1~deb7u134.0.1847.116-134.0.1847.116-1~deb7u134.0.1847.116-234.0.1847.132-134.0.1847.132-1~deb7u134.0.1847.137-134.0.1847.137-1~deb7u135.0.1916.114-1~deb7u135.0.1916.86-135.0.1916.99-1 |
35.0.1916.114-1~deb7u2 |
chromium-browserUbuntu:14.04:LTS |
before 36.0.1985.125-0ubuntu1.14.04.0~pkg1029, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 |
36.0.1985.125-0ubuntu1.14.04.0~pkg1029 |
chromiumopenSUSE:Tumbleweed From an advisory covering 719 CVEs |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1747 is a medium vulnerability (CVSS 4.3) in Google Chrome, published May 21, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 79th percentile. Fixed in chromium-browser 36.0.1985.125-0ubuntu1.14.04.0~pkg1029.
References
debian.org/security/2014/dsa-2939
googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
security.gentoo.org/glsa/glsa-201408-16.xml
lists.opensuse.org/opensuse-updates/2014-06/msg00023.html
src.chromium.org/viewvc/blink?revision=169499&view=revision
secunia.com/advisories/59155
Show 194 moreShow less
securitytracker.com/id/1030270
code.google.com/p/chromium/issues/detail?id=330663
nvd.nist.gov/vuln/detail/CVE-2014-1747
github.com/advisories/GHSA-2574-fqfw-fxcc
ubuntu.com/security/CVE-2014-1747
cve.org/CVERecord?id=CVE-2014-1747
suse.com/security/cve/CVE-2011-3015
Left out here: 2,145 references. The JSON record has them.