Every CVESearch/Get API key

CVE-2012-4930

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products,...

2.6 Low

CVE-2012-4930 is a low vulnerability (CVSS 2.6) in Google Chrome, published September 15, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. No source names a fixed version.

What does this mean?
Severity
2.6 LowCVSS 2.0, NVD
Exploit chance
2.08%EPSS, 81st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Exploit likelihood

2.08%Up 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

What each source reports

NVD Score used2.6

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
CVE-2012-4930
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
CVE-2012-4930
Updated
2026-11-02
EUVDEUVD-2012-4855No score

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
EUVD-2012-4855
Updated
2026-11-03
GitHub AdvisoriesGHSA-g4fh-wrxx-g83wNo score

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products,...

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
GHSA-g4fh-wrxx-g83w
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open