VulnerabilityModified

CVE-2011-3966

Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data.

HIGH 7.5EPSS 2.00%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.00% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: google/chrome · apple/itunes · apple/safari · apple/iphone os
Source: chrome-cve-admin@google.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.