A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NGoogle Closure Library
APPGoogle< 20200315
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2025-10585CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
CVE-2024-7971CRITICAL9.6⚠ KEVPL ✓ten sam vendor
Type confusion w V8 (Google Chrome/Edge) umożliwiający heap corruption
CVE-2024-5274CRITICAL9.6⚠ KEVPL ✓ten sam vendor
Type Confusion w V8 (Google Chrome) — RCE przez spreparowaną stronę HTML
CVE-2024-4947CRITICAL9.6⚠ KEVPL ✓ten sam vendor
Type Confusion w silniku V8 Chrome — zdalne wykonanie kodu (RCE)
CVE-2024-4671CRITICAL9.6⚠ KEVPL ✓ten sam vendor
Use-after-free w Google Chrome Visuals umożliwiający ucieczkę z sandbox