CVE-2010-1767

CVE-2010-1767 is a medium-severity vulnerability in Google Chrome with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-352.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.8)
• EPSS exploit prediction: 1% (57th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-352
• Affected product: Google Chrome
• Published: 2010-09-24
• Last modified: 2026-06-16

Description

Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.

Frequently asked questions

What is CVE-2010-1767?

Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.

How severe is CVE-2010-1767?

CVE-2010-1767 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2010-1767 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-1767?

CVE-2010-1767 primarily affects Google Chrome. In total, 235 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2010-1767?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2010-1767 published?

CVE-2010-1767 was published on 2010-09-24 and last updated on 2026-06-16.

References

• http://code.google.com/p/chromium/issues/detail?id=39698
• http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://osvdb.org/64002
• http://secunia.com/advisories/39544
• http://secunia.com/advisories/41856
• http://secunia.com/advisories/43068
• http://security-tracker.debian.org/tracker/CVE-2010-1767
• http://trac.webkit.org/changeset/57041
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
• http://www.securityfocus.com/bid/39603
• http://www.ubuntu.com/usn/USN-1006-1
• http://www.vupen.com/english/advisories/2010/2722
• http://www.vupen.com/english/advisories/2011/0212
• http://www.vupen.com/english/advisories/2011/0552
• https://bugs.webkit.org/show_bug.cgi?id=36843
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11140

Affected products (235)

• cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:1.0.154.53:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:1.0.154.59:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:1.0.154.64:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:1.0.154.65:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.2:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.21:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.24:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.25:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.27:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.33:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.36:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.37:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:3.0.195.38:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.212.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.212.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.221.8:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.222.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.222.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.222.5:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.222.12:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.2:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.4:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.5:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.7:*:*:*:*:*:*:*
• cpe:2.3:a:google:chrome:4.0.223.8:*:*:*:*:*:*:*

More vulnerabilities in Google Chrome

• CVE-2026-13782 — Critical (CVSS 10.0): Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the…
• CVE-2015-8548 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow…
• CVE-2015-6791 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service…
• CVE-2015-6788 — Critical (CVSS 10.0): The ObjectBackedNativeHandler class in extensions/renderer/object_backed_native_handler.cc in the extensions subsystem…
• CVE-2015-8480 — Critical (CVSS 10.0): The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before…
• CVE-2015-6787 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service…

All CVEs affecting Google Chrome →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

• CVE-2025-32642 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This…
• CVE-2025-23922 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a…
• CVE-2017-5145 — Critical (CVSS 10.0): An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware…
• CVE-2019-25729 — Critical (CVSS 9.8): PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute…
• CVE-2025-48340 — Critical (CVSS 9.8): Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows…
• CVE-2025-2907 — Critical (CVSS 9.8): The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing…

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →