CVE-2010-4575

Vulnerability

The ThemeInstalledInfoBarDelegate::Observe function in browser/extensions/theme_installed_infobar_delegate.cc does not properly handle incorrect tab interaction by an extension. This flaw exists in Google Chrome versions before 8.0.552.224 and Chrome OS versions before 8.0.552.343 [1]. The vulnerability is reachable when a user installs a crafted extension that interacts with browser tabs in an unexpected manner.

Exploitation

An attacker must first convince a user to install a malicious extension. The user then needs to perform a specific set of UI actions involving tab interaction, as triggered by the extension [1]. The exact sequence of actions is not publicly detailed, but the extension's code can cause the Observe function to mishandle the tab interaction, leading to a crash.

Impact

Successful exploitation results in a denial of service (application crash) of the browser or Chrome OS [1]. While the official CVE description only confirms a crash, the Gentoo advisory notes that similar vulnerabilities in the same release may allow arbitrary code execution within the sandbox [1]. However, for this specific CVE, the impact is limited to a denial of service.

Mitigation

Users should upgrade to Google Chrome 8.0.552.224 or later, or Chrome OS 8.0.552.343 or later [1]. The Gentoo Linux advisory provides the command emerge --sync && emerge --ask --oneshot --verbose ">=www-client/chromium-8.0.552.224" for Chromium users [1]. No workaround is available.