CVE-2010-0650 in Chrome
Summary
by MITRE
WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2010-0650 represents a significant security flaw in WebKit-based browsers that affected both Google Chrome and Apple Safari. This issue stems from improper handling of mouse click events within the browser's popup window restriction mechanisms, creating a pathway for remote attackers to circumvent intended security controls. The vulnerability specifically targets the browser's popup window blocking functionality, which is designed to prevent malicious websites from opening unwanted windows that could be used for phishing, malicious redirects, or other harmful activities.
The technical flaw manifests in how WebKit processes mouse click events when attempting to open popup windows. Under normal circumstances, browsers enforce strict restrictions on popup windows to prevent unauthorized creation, typically requiring user interaction such as a mouse click or keyboard event to validate popup requests. However, the vulnerability in question allows attackers to craft specific HTML content and JavaScript code that manipulates the timing and sequence of mouse events to bypass these restrictions. This manipulation exploits a gap in the event handling system where the browser's popup blocker fails to properly validate the authenticity of click events that trigger popup window creation, enabling attackers to open windows without proper user consent or awareness.
The operational impact of this vulnerability extends beyond simple privacy concerns to encompass potential security breaches and user deception. Attackers can leverage this flaw to open malicious popup windows that appear legitimate to users, potentially leading to credential theft, malware distribution, or social engineering attacks. The vulnerability particularly affects users browsing untrusted websites where attackers can inject malicious code that takes advantage of the popup bypass mechanism. This creates a vector for drive-by downloads, phishing campaigns, and other malicious activities that would normally be blocked by popup blockers, effectively neutralizing an important browser security feature. The attack requires only a remote web page with malicious content, making it particularly dangerous as users may be exposed simply by visiting compromised websites.
Security professionals should note that this vulnerability aligns with CWE-602, which addresses client-side cross-site scripting vulnerabilities, and relates to techniques described in the ATT&CK framework under T1059 for command and scripting interpreter and T1203 for Exploitation for Client Execution. The flaw demonstrates how browser security mechanisms can be circumvented through subtle manipulation of event handling systems, emphasizing the importance of comprehensive security testing for web browser components. Organizations should prioritize updating affected browsers to versions that address this vulnerability, as the patch typically involves correcting the event validation logic within the WebKit rendering engine. Additionally, users should be educated about the risks of visiting untrusted websites and the importance of keeping browsers updated. The vulnerability also highlights the need for robust input validation and event handling in web applications, as similar issues could potentially exist in other browser components or web frameworks that rely on similar event processing mechanisms.