CVE:CVE-2009-2352
CNNVD:CNNVD-200907-100
Google Chrome 1.0.154.48以及之前版本不阻拦HTTP响应的Refresh页眉中的javascript:URIs。远程攻击者可以借助与注入刷新页眉 (injecting a Refresh header)相关的向量或与指定刷新页眉的内容(specifying the content of a Refresh header)相关的向量执行跨站脚本攻击。
solution:Upgrade google chrome to a higher version than 1.0.154.48,0.2.149.29,0.2.149.30,0.2.152.1,0.2.153.1,0.3.154.0,0.3.154.3,0.4.154.18,0.4.154.22,0.4.154.31,0.4.154.33,1.0.154.36,1.0.154.39,1.0.154.42,1.0.154.43,1.0.154.46,and avoid the version (,1.0.154.48],0.2.149.29,0.2.149.30,0.2.152.1,0.2.153.1,0.3.154.0,0.3.154.3,0.4.154.18,0.4.154.22,0.4.154.31,0.4.154.33,1.0.154.36,1.0.154.39,1.0.154.42,1.0.154.43,1.0.154.46