CVE-2010-2301

Vulnerability

A cross-site scripting (XSS) vulnerability exists in WebCore's editing/markup.cpp within WebKit, affecting Google Chrome prior to version 5.0.375.70. The flaw occurs in the appendStartMarkup function when processing TEXTAREA elements. When the node.innerHTML property of a TEXTAREA is read, the characters inside are not properly HTML-entity encoded, allowing an attacker to inject arbitrary HTML or script. This issue is tracked in WebKit bug 38922 [1] and may overlap with CVE-2010-1762.

Exploitation

An attacker can craft a web page containing a TEXTAREA element with malicious content, such as `. When the page's JavaScript reads the innerHTML of that TEXTAREA, the injected markup is decompiled without proper escaping, causing the script to execute. No authentication or special network position is required; the victim only needs to visit the malicious page or view content that triggers the innerHTML` read [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script in the context of the affected origin. This can lead to data theft, session hijacking, defacement, or other malicious actions typically associated with stored or reflected XSS. The attack runs with the privileges of the user's browser session [1].

Mitigation

The vulnerability is fixed in Google Chrome version 5.0.375.70 and later. Users should update their browser to the latest version. The WebKit project committed a patch that HTML-entity encodes the output for TEXTAREA elements. Other WebKit-based browsers (e.g., Safari) should apply the corresponding vendor patches. No workaround is available other than upgrading [1].