CVE-2014-3166
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS...
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
Exploit likelihood
What each source reports
NVD Score used
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- Record
CVE-2014-3166- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- Record
CVE-2014-3166- Updated
- 2026-11-02
EUVDEUVD-2014-3184 No score
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- Record
EUVD-2014-3184- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mjp-hj3c-3vxc No score
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS...
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- Record
GHSA-7mjp-hj3c-3vxc- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3166 No score
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- Record
UBUNTU-CVE-2014-3166- Updated
- 2026-11-02
OSVUSN-2320-1 No score
oxide-qt vulnerabilities
A use-after-free was discovered in the websockets implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2014-3165)
An issue was discovered in the Public Key Pinning implementation in Chromium. An attacker could potentially exploit this to obtain sensitive information. (CVE-2014-3166)
Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-3167)
- Record
USN-2320-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 |
before 37.0.2062.120-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 45 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-329.0.1547.57-129.0.1547.57-1~deb7u129.0.1547.57-229.0.1547.57-329.0.1547.57-3+exp130.0.1599.101-130.0.1599.101-1~deb7u130.0.1599.101-230.0.1599.101-331.0.1650.57-131.0.1650.57-1~deb7u131.0.1650.63-131.0.1650.63-1~deb7u132.0.1700.123-132.0.1700.123-1~deb7u132.0.1700.123-232.0.1700.123-332.0.1700.123-433.0.1750.152-133.0.1750.152-1~deb7u134.0.1847.116-134.0.1847.116-1~deb7u134.0.1847.116-234.0.1847.132-134.0.1847.132-1~deb7u134.0.1847.137-134.0.1847.137-1~deb7u135.0.1916.114-135.0.1916.114-1~deb7u135.0.1916.114-1~deb7u235.0.1916.114-235.0.1916.153-135.0.1916.153-1~deb7u135.0.1916.153-235.0.1916.86-135.0.1916.99-136.0.1985.103-1 |
37.0.2062.120-1~deb7u1 |
chromium-browserUbuntu:14.04:LTS |
before 37.0.2062.94-0ubuntu0.14.04.1~pkg1042, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu236.0.1985.125-0ubuntu1.14.04.0~pkg1029 |
37.0.2062.94-0ubuntu0.14.04.1~pkg1042 |
oxide-qtUbuntu:14.04:LTS |
before 1.0.5-0ubuntu0.14.04.1, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu11.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.1 |
1.0.5-0ubuntu0.14.04.1 |
chromiumopenSUSE:Tumbleweed |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3166 is a medium vulnerability (CVSS 4.3) in Debian Linux, published August 13, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in chromium-browser 37.0.2062.120-1~deb7u1.
References
src.chromium.org/viewvc/chrome?revision=286598&view=revision
secunia.com/advisories/59693
ietf.org/mail-archive/web/tls/current/msg13345.html
googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
Show 194 moreShow less
security.gentoo.org/glsa/glsa-201408-16.xml
code.google.com/p/chromium/issues/detail?id=398925
securityfocus.com/bid/69202
debian.org/security/2014/dsa-3039
securitytracker.com/id/1030732
nvd.nist.gov/vuln/detail/CVE-2014-3166
github.com/advisories/GHSA-7mjp-hj3c-3vxc
ubuntu.com/security/CVE-2014-3166
cve.org/CVERecord?id=CVE-2014-3166
launchpad.net/bugs/1356372
suse.com/security/cve/CVE-2011-3015
Left out here: 11 versions and 2,155 references. The JSON record has them.