CVE-2010-0661 in Chrome
Summary
by MITRE
WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability identified as CVE-2010-0661 represents a critical security flaw in the WebKit rendering engine that affected Google Chrome browser versions prior to 4.0.249.78. This issue resides within the WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp file and specifically targets the window.open method implementation. The vulnerability enables remote attackers to circumvent the fundamental Same Origin Policy that serves as a cornerstone of web security by creating cross-origin access paths through improper handling of window.open operations. The flaw demonstrates a classic violation of web security boundaries where legitimate browser functionality becomes a vector for privilege escalation and unauthorized data access.
The technical nature of this vulnerability stems from improper validation and handling of cross-origin window operations within the V8 JavaScript engine bindings layer of WebKit. When the window.open method is invoked with certain parameters, the implementation fails to properly enforce origin restrictions that should prevent scripts from accessing windows or frames from different origins. This misconfiguration allows attackers to craft malicious JavaScript code that can open windows across different origins and subsequently access their properties or methods without proper authorization. The vulnerability specifically affects the V8DOMWindowCustom.cpp file which handles the JavaScript bindings for DOM window objects, creating a pathway for bypassing the browser's security model through the JavaScript execution environment.
The operational impact of CVE-2010-0661 extends beyond simple cross-origin access, as it provides attackers with the capability to perform sophisticated attacks such as cross-site scripting exploitation, session hijacking, and data exfiltration. Attackers can leverage this vulnerability to open windows on different domains and then manipulate the window objects to gain unauthorized access to sensitive information or perform actions on behalf of users. This flaw particularly affects web applications that rely on the Same Origin Policy for security enforcement, as it undermines the fundamental security model that protects users from malicious websites attempting to access data from other origins. The vulnerability's impact is amplified because it affects a core browser functionality that is widely used and trusted by web applications and users alike.
Mitigation strategies for CVE-2010-0661 primarily focus on updating to patched versions of Google Chrome and WebKit-based browsers where the vulnerability has been addressed through proper implementation of origin checking in the window.open method. Organizations should immediately apply security patches to all affected browser versions and conduct thorough security assessments to identify potential exploitation attempts. Additionally, web developers should implement defensive programming practices such as validating all cross-origin window operations and avoiding the use of potentially vulnerable window.open parameters. The vulnerability aligns with CWE-284 which addresses improper access control, and relates to ATT&CK techniques involving privilege escalation and credential access through browser-based exploits. Security monitoring should include detection of suspicious window.open operations and cross-origin access patterns that could indicate exploitation attempts.