Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows…

Description

Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.

Scores

EPSS (exploitation in 30 days)

1.0% · top 37% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Weakness

• n/a
• CWE-264 (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (6)

• http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.html (opens in a new tab)x_refsource_MISCx_transferred
• http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies (opens in a new tab)x_refsource_MISCx_transferred
• http://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.html (opens in a new tab)x_refsource_MISCx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=660053 (opens in a new tab)x_refsource_MISCx_transferred
• [public-webapps] 20090918 fyi: Strict Transport Security specification (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 17 Sept 2024, 01:46 UTC.