CVE-2010-0664 in Chrome
Summary
by MITRE
Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability described in CVE-2010-0664 represents a stack consumption issue within Google Chrome's security policy implementation that specifically targets the ChildProcessSecurityPolicy::CanRequestURL function. This flaw exists in the browser/child_process_security_policy.cc source file and affects Chrome versions prior to 4.0.249.78, making it a significant concern for users of older browser versions. The vulnerability stems from inadequate input validation and processing of URL protocols within the browser's security framework, creating an exploitable condition that can be triggered through maliciously crafted web content.
The technical mechanism behind this vulnerability involves the improper handling of URLs that contain multiple protocol specifications, particularly those beginning with repeated instances of the view-source: protocol prefix. When Chrome processes such URLs, the ChildProcessSecurityPolicy::CanRequestURL function consumes excessive stack memory during protocol parsing and validation operations. This occurs because the function does not properly limit the number of protocol specifications it will process or the depth of recursive parsing operations, leading to stack exhaustion when confronted with URLs containing numerous repetitions of the view-source: substring. The vulnerability operates at the protocol parsing layer, where each repeated protocol specification contributes to stack frame accumulation until system resources are depleted.
The operational impact of this vulnerability manifests as a denial of service condition that can simultaneously cause both memory consumption exhaustion and application crashes. Remote attackers can exploit this weakness by crafting malicious URLs that contain multiple protocol specifications, particularly those with repeated view-source: prefixes, which forces Chrome to consume excessive stack memory during processing. The resulting system instability can lead to complete browser termination, requiring users to restart the application and potentially disrupting ongoing work or browsing sessions. This type of vulnerability is particularly concerning in enterprise environments where browser stability directly impacts productivity and user experience.
This vulnerability maps to CWE-401: "Improper Release of Memory Before Removing Last Reference" and CWE-674: "Uncontrolled Recursion" within the Common Weakness Enumeration framework, indicating both memory management issues and recursive processing flaws. The attack pattern aligns with the ATT&CK technique T1499.004: "Utilities: Endpoint Denial of Service" where adversaries leverage application vulnerabilities to consume system resources. The exploit requires no special privileges and can be executed through standard web browsing activities, making it particularly dangerous for widespread exploitation. Organizations should prioritize patching affected Chrome versions to address this vulnerability, as the fix in Chrome 4.0.249.78 includes enhanced input validation and stack consumption limits within the protocol parsing logic.
Mitigation strategies for this vulnerability include immediate deployment of Chrome updates to version 4.0.249.78 or later, which contain the necessary security patches. Network administrators should implement web filtering solutions to block suspicious URLs containing repeated protocol specifications, though this approach may impact legitimate web content. Browser security policies should be reviewed to ensure proper input validation is in place for URL processing, and regular security audits should verify that similar vulnerabilities do not exist in other protocol handling components. Additionally, user education regarding the dangers of visiting untrusted websites and the importance of keeping browser software updated remains crucial for overall security posture.
The vulnerability demonstrates the critical importance of proper stack management and input validation in browser security implementations. Modern web browsers must carefully balance functionality with security considerations, particularly when handling complex URL structures and protocol specifications. The fix implemented by Google likely involved adding recursion depth limits and memory consumption checks within the protocol parsing functions, preventing excessive stack allocation while maintaining legitimate browser functionality. This incident underscores the ongoing need for security-focused development practices and regular vulnerability assessments in complex software systems like web browsers, where even seemingly minor implementation flaws can result in significant security risks and user impact.