{"id":"CVE-2013-2873","aliases":["DSA-2724-1","EUVD-2013-2812","GHSA-v8v7-hvv6-whw9","MGASA-2013-0234"],"status":"published","title":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to...","description":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01272,"percentile":0.70066,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-399","CWE-416"],"published":"2013-07-10T10:00:00Z","modified":"2026-06-16T23:54:07Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.0.1500.71-1~deb7u1"}]}],"versions":["26.0.1410.43-1","27.0.1453.110-1","27.0.1453.110-1~deb7u1","27.0.1453.110-2","27.0.1453.93-1","27.0.1453.93-1~deb7u1"],"bundled":13},{"source":"osv","ecosystem":"Mageia:2","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.0.1500.71-1.mga2"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:3","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.0.1500.71-1.mga3"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:3","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.0.1500.71-1.mga3.tainted"}]}],"bundled":12}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"google","product":"chrome"}],"references":[{"url":"http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=4d64b2d296d5de448ab04c4e5af5c7daa2d8e8f8","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://code.google.com/p/chromium/issues/detail?id=241139","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17371","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2724","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2873"},{"url":"http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=commit;h=4d64b2d296d5de448ab04c4e5af5c7daa2d8e8f8"},{"url":"https://github.com/advisories/GHSA-v8v7-hvv6-whw9"},{"url":"https://advisories.mageia.org/MGASA-2013-0234.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10804","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2873","description":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.","status":"published","published":"2013-07-10T10:00:00Z","modified":"2024-08-06T15:52:21.321Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2812","description":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.","status":"published","published":"2013-07-10T10:00:00Z","modified":"2024-08-06T15:52:21Z","updated_at":"2026-11-03T01:56:37.16587Z"}],"ghsa":[{"id":"GHSA-v8v7-hvv6-whw9","title":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to...","description":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.","status":"published","published":"2022-05-17T00:54:47Z","modified":"2025-04-11T04:12:54Z","updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-2873","description":"Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.","status":"published","published":"2013-07-10T10:55:01.997Z","modified":"2026-06-16T23:54:07.21Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-399","CWE-416"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"DSA-2724-1","title":"chromium-browser - several","status":"published","published":"2013-07-17T00:00:00Z","modified":"2026-03-09T01:21:42.992693Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0234","title":"Updated chromium-browser-stable packages fix security vulnerabilities","description":"Updated chromium-browser-stable packages fix security vulnerabilities:\n\nThe HTTPS implementation does not ensure that headers are terminated by\n\\r\\n\\r\\n (carriage return, newline, carriage return, newline)\n(CVE-2013-2853).\n\nChrome does not properly prevent pop-under windows (CVE-2013-2867).\n\ncommon/extensions/sync_helper.cc proceeds with sync operations for NPAPI\nextensions without checking for a certain plugin permission setting\n(CVE-2013-2868).\n\nDenial of service (out-of-bounds read) via a crafted JPEG2000 image\n(CVE-2013-2869).\n\nUse-after-free vulnerability in network sockets (CVE-2013-2870).\n\nUse-after-free vulnerability in input handling (CVE-2013-2871).\n\nUse-after-free vulnerability in resource loading (CVE-2013-2873).\n\nOut-of-bounds read in SVG file handling (CVE-2013-2875).\n\nChrome does not properly enforce restrictions on the capture of screenshots\nby extensions, which could lead to information disclosure from previous page\nvisits (CVE-2013-2876).\n\nOut-of-bounds read in text handling (CVE-2013-2878).\n\nThe circumstances in which a renderer process can be considered a trusted\nprocess for sign-in and subsequent sync operations were not propertly\nchecked (CVE-2013-2879).\n\nThe chrome 28 development team found various issues from internal fuzzing,\naudits, and other studies (CVE-2013-2880).\n","status":"published","published":"2013-07-26T11:52:03Z","modified":"2026-04-16T04:44:47.82722065Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}