CVE-2011-3881

Vulnerability

Multiple Same Origin Policy (SOP) bypass vulnerabilities exist in WebKit, as used in Google Chrome before version 15.0.874.102 and Android before version 4.4 (KitKat) [1]. One notable vector involves the HTMLPlugInImageElement::allowedToLoadFrameURL function, which fails to validate javascript: URLs when loading frame content for plugin elements (e.g., `) [2]. This allows an attacker to change the data attribute of a plugin element from a legitimate cross-origin URL to a javascript:` URL after the element has loaded, thereby executing arbitrary script in the context of the plugin's original origin [1]. The issue is present in WebKit code prior to the fix committed in [2].

Exploitation

An attacker can exploit this vulnerability without authentication by enticing a victim to visit a crafted web page [1]. The attack involves the following steps: create an ` element with a data attribute pointing to a cross-origin URL (e.g., http://www.bing.com), append it to the document, wait for it to load, then set the data attribute to a javascript: URL (e.g., javascript:alert(document.domain)) and set innerHTML` to trigger the navigation [1]. The browser then executes the JavaScript in the context of the plugin's original origin, bypassing the SOP [1].

Impact

Successful exploitation allows remote attackers to bypass the Same Origin Policy and conduct Universal Cross-Site Scripting (UXSS) attacks [1]. This means an attacker can execute arbitrary JavaScript in the context of any website, potentially stealing cookies, session tokens, or other sensitive data, and performing actions on behalf of the victim in a different origin [1]. The impact is limited to the web content realm; no system-level compromise is implied.

Mitigation

The vulnerability is fixed in Google Chrome version 15.0.874.102 and later [1]. For Android, the fix is included in Android 4.4 (KitKat) and later versions [1]. The specific code fix for the HTMLPlugInImageElement vector was committed as cherry-pick r96826 to the Android WebKit repository [2]. Users should update their browsers or devices to the latest available versions. No workaround is available for unpatched systems. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.