Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.

Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.

Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method. Google Chrome for iOS is prone to a cross-domain scripting vulnerability because the application fails to properly enforce the same-origin policy. Successful exploits will allow attackers to execute arbitrary script code within the context of the affected domain. Versions prior to Chrome for iOS 21.0.1180.82 are vulnerable. Google Chrome is a web browser developed by Google (Google). The vulnerability stems from the fact that the program does not call the WebView method correctly