CVE-2010-1767

Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.

Published: 2010-09-24 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2010-1767 is rated Moderate Risk (47.4/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.96%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2010-1767

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.63% 0.96% +0.33%
2 2025-03-17 0.38% 0.63% +0.25%
3 2023-03-07 — 0.38% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2010-1767

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.8 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 6.4 [email protected]

Weakness enumeration for CVE-2010-1767

OS Trackers for CVE-2010-1767

vendor priority summary link
ubuntu low CVE-2010-1767 low priority: Ubuntu including 3 source packages (chromium-browser, qt4-x11, webkit), 27 status rows across 9 suites (dapper, hardy, jaunty, karmic, lucid, maverick, natty, oneiric, upstream): not-affected 12, DNE 5, ignored 5, needs-triage 3, released 2. https://ubuntu.com/security/CVE-2010-1767

Affected software / configurations for CVE-2010-1767

Vendor Product Version Raw CPE
google chrome <= 4.1.249.1058 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
google chrome 1.0.154.53 cpe:2.3:a:google:chrome:1.0.154.53:*:*:*:*:*:*:*
google chrome 1.0.154.59 cpe:2.3:a:google:chrome:1.0.154.59:*:*:*:*:*:*:*
google chrome 1.0.154.64 cpe:2.3:a:google:chrome:1.0.154.64:*:*:*:*:*:*:*
google chrome 1.0.154.65 cpe:2.3:a:google:chrome:1.0.154.65:*:*:*:*:*:*:*
google chrome 2.0.169.0 cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:*
google chrome 2.0.169.1 cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:*
google chrome 2.0.170.0 cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:*
google chrome 2.0.172.2 cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:*
google chrome 2.0.172.8 cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:*
google chrome 2.0.172.27 cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:*
google chrome 2.0.172.28 cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:*
google chrome 2.0.172.30 cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:*
google chrome 2.0.172.33 cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:*
google chrome 2.0.172.37 cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:*
google chrome 2.0.172.38 cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:*
google chrome 3.0.182.2 cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:*
google chrome 3.0.195.2 cpe:2.3:a:google:chrome:3.0.195.2:*:*:*:*:*:*:*
google chrome 3.0.195.21 cpe:2.3:a:google:chrome:3.0.195.21:*:*:*:*:*:*:*
google chrome 3.0.195.24 cpe:2.3:a:google:chrome:3.0.195.24:*:*:*:*:*:*:*
google chrome 3.0.195.25 cpe:2.3:a:google:chrome:3.0.195.25:*:*:*:*:*:*:*
google chrome 3.0.195.27 cpe:2.3:a:google:chrome:3.0.195.27:*:*:*:*:*:*:*
google chrome 3.0.195.33 cpe:2.3:a:google:chrome:3.0.195.33:*:*:*:*:*:*:*
google chrome 3.0.195.36 cpe:2.3:a:google:chrome:3.0.195.36:*:*:*:*:*:*:*
google chrome 3.0.195.37 cpe:2.3:a:google:chrome:3.0.195.37:*:*:*:*:*:*:*
google chrome 3.0.195.38 cpe:2.3:a:google:chrome:3.0.195.38:*:*:*:*:*:*:*
google chrome 4.0.212.0 cpe:2.3:a:google:chrome:4.0.212.0:*:*:*:*:*:*:*
google chrome 4.0.212.1 cpe:2.3:a:google:chrome:4.0.212.1:*:*:*:*:*:*:*
google chrome 4.0.221.8 cpe:2.3:a:google:chrome:4.0.221.8:*:*:*:*:*:*:*
google chrome 4.0.222.0 cpe:2.3:a:google:chrome:4.0.222.0:*:*:*:*:*:*:*
google chrome 4.0.222.1 cpe:2.3:a:google:chrome:4.0.222.1:*:*:*:*:*:*:*
google chrome 4.0.222.5 cpe:2.3:a:google:chrome:4.0.222.5:*:*:*:*:*:*:*
google chrome 4.0.222.12 cpe:2.3:a:google:chrome:4.0.222.12:*:*:*:*:*:*:*
google chrome 4.0.223.0 cpe:2.3:a:google:chrome:4.0.223.0:*:*:*:*:*:*:*
google chrome 4.0.223.1 cpe:2.3:a:google:chrome:4.0.223.1:*:*:*:*:*:*:*
google chrome 4.0.223.2 cpe:2.3:a:google:chrome:4.0.223.2:*:*:*:*:*:*:*
google chrome 4.0.223.4 cpe:2.3:a:google:chrome:4.0.223.4:*:*:*:*:*:*:*
google chrome 4.0.223.5 cpe:2.3:a:google:chrome:4.0.223.5:*:*:*:*:*:*:*
google chrome 4.0.223.7 cpe:2.3:a:google:chrome:4.0.223.7:*:*:*:*:*:*:*
google chrome 4.0.223.8 cpe:2.3:a:google:chrome:4.0.223.8:*:*:*:*:*:*:*
google chrome 4.0.223.9 cpe:2.3:a:google:chrome:4.0.223.9:*:*:*:*:*:*:*
google chrome 4.0.224.0 cpe:2.3:a:google:chrome:4.0.224.0:*:*:*:*:*:*:*
google chrome 4.0.229.1 cpe:2.3:a:google:chrome:4.0.229.1:*:*:*:*:*:*:*
google chrome 4.0.235.0 cpe:2.3:a:google:chrome:4.0.235.0:*:*:*:*:*:*:*
google chrome 4.0.236.0 cpe:2.3:a:google:chrome:4.0.236.0:*:*:*:*:*:*:*
google chrome 4.0.237.0 cpe:2.3:a:google:chrome:4.0.237.0:*:*:*:*:*:*:*
google chrome 4.0.237.1 cpe:2.3:a:google:chrome:4.0.237.1:*:*:*:*:*:*:*
google chrome 4.0.239.0 cpe:2.3:a:google:chrome:4.0.239.0:*:*:*:*:*:*:*
google chrome 4.0.240.0 cpe:2.3:a:google:chrome:4.0.240.0:*:*:*:*:*:*:*
google chrome 4.0.241.0 cpe:2.3:a:google:chrome:4.0.241.0:*:*:*:*:*:*:*
google chrome 4.0.242.0 cpe:2.3:a:google:chrome:4.0.242.0:*:*:*:*:*:*:*
google chrome 4.0.243.0 cpe:2.3:a:google:chrome:4.0.243.0:*:*:*:*:*:*:*
google chrome 4.0.244.0 cpe:2.3:a:google:chrome:4.0.244.0:*:*:*:*:*:*:*
google chrome 4.0.245.0 cpe:2.3:a:google:chrome:4.0.245.0:*:*:*:*:*:*:*
google chrome 4.0.245.1 cpe:2.3:a:google:chrome:4.0.245.1:*:*:*:*:*:*:*
google chrome 4.0.246.0 cpe:2.3:a:google:chrome:4.0.246.0:*:*:*:*:*:*:*
google chrome 4.0.247.0 cpe:2.3:a:google:chrome:4.0.247.0:*:*:*:*:*:*:*
google chrome 4.0.248.0 cpe:2.3:a:google:chrome:4.0.248.0:*:*:*:*:*:*:*
google chrome 4.0.249.0 cpe:2.3:a:google:chrome:4.0.249.0:*:*:*:*:*:*:*
google chrome 4.0.249.1 cpe:2.3:a:google:chrome:4.0.249.1:*:*:*:*:*:*:*
google chrome 4.0.249.2 cpe:2.3:a:google:chrome:4.0.249.2:*:*:*:*:*:*:*
google chrome 4.0.249.3 cpe:2.3:a:google:chrome:4.0.249.3:*:*:*:*:*:*:*
google chrome 4.0.249.4 cpe:2.3:a:google:chrome:4.0.249.4:*:*:*:*:*:*:*
google chrome 4.0.249.5 cpe:2.3:a:google:chrome:4.0.249.5:*:*:*:*:*:*:*
google chrome 4.0.249.6 cpe:2.3:a:google:chrome:4.0.249.6:*:*:*:*:*:*:*
google chrome 4.0.249.7 cpe:2.3:a:google:chrome:4.0.249.7:*:*:*:*:*:*:*
google chrome 4.0.249.8 cpe:2.3:a:google:chrome:4.0.249.8:*:*:*:*:*:*:*
google chrome 4.0.249.9 cpe:2.3:a:google:chrome:4.0.249.9:*:*:*:*:*:*:*
google chrome 4.0.249.10 cpe:2.3:a:google:chrome:4.0.249.10:*:*:*:*:*:*:*
google chrome 4.0.249.11 cpe:2.3:a:google:chrome:4.0.249.11:*:*:*:*:*:*:*
google chrome 4.0.249.12 cpe:2.3:a:google:chrome:4.0.249.12:*:*:*:*:*:*:*
google chrome 4.0.249.14 cpe:2.3:a:google:chrome:4.0.249.14:*:*:*:*:*:*:*
google chrome 4.0.249.16 cpe:2.3:a:google:chrome:4.0.249.16:*:*:*:*:*:*:*
google chrome 4.0.249.17 cpe:2.3:a:google:chrome:4.0.249.17:*:*:*:*:*:*:*
google chrome 4.0.249.18 cpe:2.3:a:google:chrome:4.0.249.18:*:*:*:*:*:*:*
google chrome 4.0.249.19 cpe:2.3:a:google:chrome:4.0.249.19:*:*:*:*:*:*:*
google chrome 4.0.249.20 cpe:2.3:a:google:chrome:4.0.249.20:*:*:*:*:*:*:*
google chrome 4.0.249.21 cpe:2.3:a:google:chrome:4.0.249.21:*:*:*:*:*:*:*
google chrome 4.0.249.22 cpe:2.3:a:google:chrome:4.0.249.22:*:*:*:*:*:*:*
google chrome 4.0.249.23 cpe:2.3:a:google:chrome:4.0.249.23:*:*:*:*:*:*:*

References for CVE-2010-1767

URL Tags
http://code.google.com/p/chromium/issues/detail?id=39698
http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://osvdb.org/64002
http://secunia.com/advisories/39544 Vendor Advisory
http://secunia.com/advisories/41856
http://secunia.com/advisories/43068
http://security-tracker.debian.org/tracker/CVE-2010-1767
http://trac.webkit.org/changeset/57041
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
http://www.securityfocus.com/bid/39603
http://www.ubuntu.com/usn/USN-1006-1
http://www.vupen.com/english/advisories/2010/2722
http://www.vupen.com/english/advisories/2011/0212
http://www.vupen.com/english/advisories/2011/0552
https://bugs.webkit.org/show_bug.cgi?id=36843
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11140
cvelogic Threat Intelligence