{"api_version":"1","generated_at":"2026-07-23T07:50:04+00:00","cve":"CVE-2014-3197","urls":{"html":"https://cve.report/CVE-2014-3197","api":"https://cve.report/api/cve/CVE-2014-3197.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3197","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3197"},"summary":{"title":"CVE-2014-3197","description":"The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.","state":"PUBLISHED","assigner":"Chrome","published_at":"2014-10-08 10:55:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/70273","name":"http://www.securityfocus.com/bid/70273","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Prior to 38.0.2125.101 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html","name":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chrome Releases: Stable Channel Update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision","name":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[blink] Revision 179240","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1626.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1626.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://crbug.com/396544","name":"https://crbug.com/396544","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 396544 - \n chromium -\n \n Security: XSS filter information leak - \n An open-source project to help move the web forward. - Google Project Hosting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3197","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3197","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3197","vulnerable":"1","versionEndIncluding":"38.0.2125.7","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"chrome","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3197","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_desktop_supplementary","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3197","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server_supplementary","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3197","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server_supplementary_eus","cpe6":"6.6.z","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3197","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_workstation_supplementary","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:35:57.081Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2014:1626","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1626.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://crbug.com/396544"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision"},{"name":"70273","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/70273"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-10-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-25T19:57:01.000Z","orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome"},"references":[{"name":"RHSA-2014:1626","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1626.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://crbug.com/396544"},{"tags":["x_refsource_CONFIRM"],"url":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision"},{"name":"70273","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/70273"},{"tags":["x_refsource_CONFIRM"],"url":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2014-3197","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"RHSA-2014:1626","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1626.html"},{"name":"https://crbug.com/396544","refsource":"CONFIRM","url":"https://crbug.com/396544"},{"name":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision","refsource":"CONFIRM","url":"https://src.chromium.org/viewvc/blink?revision=179240&view=revision"},{"name":"70273","refsource":"BID","url":"http://www.securityfocus.com/bid/70273"},{"name":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html","refsource":"CONFIRM","url":"http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html"}]}}}},"cveMetadata":{"assignerOrgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","assignerShortName":"Chrome","cveId":"CVE-2014-3197","datePublished":"2014-10-08T10:00:00.000Z","dateReserved":"2014-05-03T00:00:00.000Z","dateUpdated":"2024-08-06T10:35:57.081Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-08 10:55:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndIncluding":"38.0.2125.7","matchCriteriaId":"49217EEC-AE40-4FBD-A5D4-B4A323CD5645"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*","matchCriteriaId":"B8C6E104-EDBC-481E-85B8-D39ED2058D39"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*","matchCriteriaId":"4B74C62D-4A6D-4A4F-ADF6-A508322CD447"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.6.z:*:*:*:*:*:*:*","matchCriteriaId":"04A2B180-08EF-4BE1-B1F2-48782874D6DB"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*","matchCriteriaId":"6E89B38A-3697-46DD-BB3F-E8D2373588BE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3197","Ordinal":"1","Title":"CVE-2014-3197","CVE":"CVE-2014-3197","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3197","Ordinal":"1","NoteData":"The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.","Type":"Description","Title":"CVE-2014-3197"},{"CveYear":"2014","CveId":"3197","Ordinal":"2","NoteData":"2014-10-08","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3197","Ordinal":"3","NoteData":"2016-11-25","Type":"Other","Title":"Modified"}]}}}