VULNERABILITY INTELLIGENCE
CVE-2013-6166
CVSS score6.8 MEDIUM
EPSS probability1.86%
CISA KEVNot currently listed
Published2014-02-15
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)