CVE-2014-7899
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a...
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
Exploit likelihood
What each source reports
NVD Score used
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- Record
CVE-2014-7899- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- Record
CVE-2014-7899- Updated
- 2026-11-02
EUVDEUVD-2014-7749 No score
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- Record
EUVD-2014-7749- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j433-h6rv-q7xm No score
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a...
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- Record
GHSA-j433-h6rv-q7xm- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7899 No score
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- Record
UBUNTU-CVE-2014-7899- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserRed Hat:rhel_extras:6 |
before 0:39.0.2171.65-2.el6_6 | 0:39.0.2171.65-2.el6_6 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 |
before 0:39.0.2171.65-2.el6_6 | 0:39.0.2171.65-2.el6_6 |
chromiumopenSUSE:Tumbleweed |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7899 is a medium vulnerability (CVSS 5.0) in Google Chrome, published November 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in chromium-browser 0:39.0.2171.65-2.el6_6.
References
securitytracker.com/id/1031241
code.google.com/p/chromium/issues/detail?id=389734
rhn.redhat.com/errata/RHSA-2014-1894.html
securityfocus.com/bid/71160
secunia.com/advisories/60194
exchange.xforce.ibmcloud.com/vulnerabilities/98787
Show 194 moreShow less
src.chromium.org/viewvc/chrome?revision=279232&view=revision
googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html
nvd.nist.gov/vuln/detail/CVE-2014-7899
github.com/advisories/GHSA-j433-h6rv-q7xm
access.redhat.com/errata/RHSA-2014:1894
bugzilla.redhat.com/show_bug.cgi?id=1165650
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1894.json
cve.org/CVERecord?id=CVE-2014-7899
ubuntu.com/security/CVE-2014-7899
chromium.googlesource.com/chromium/src/+/5cfbddc9cc972f5133f26664dbf5810bb569cd04
suse.com/security/cve/CVE-2011-3015
Left out here: 2,175 references. The JSON record has them.