{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "same-origin-bypass in V8",
    "tracking": {
      "current_release_date": "2026-08-11T14:02:16+00:00",
      "generator": {
        "date": "2026-08-11T14:02:16+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2014-7939",
      "initial_release_date": "2015-01-21T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:02:16+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6.6",
            "product": {
              "name": "Red Hat Enterprise Linux 6.6",
              "product_id": "rhel-6.6.z.extras",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:rhel_extras:6"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser",
            "product": {
              "name": "chromium-browser",
              "product_id": "chromium-browser-0:40.0.2214.91-1.el6_6",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser@40.0.2214.91-1.el6_6?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser",
            "product": {
              "name": "chromium-browser",
              "product_id": "chromium-browser-0:40.0.2214.91-1.el6_6.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser@40.0.2214.91-1.el6_6?arch=src&epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "chromium-browser-debuginfo",
            "product": {
              "name": "chromium-browser-debuginfo",
              "product_id": "chromium-browser-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/chromium-browser-debuginfo"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-0:40.0.2214.91-1.el6_6 as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6"
        },
        "product_reference": "chromium-browser-0:40.0.2214.91-1.el6_6",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-0:40.0.2214.91-1.el6_6.src as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
        },
        "product_reference": "chromium-browser-0:40.0.2214.91-1.el6_6.src",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chromium-browser-debuginfo as a component of Red Hat Enterprise Linux 6.6",
          "product_id": "rhel-6.6.z.extras:chromium-browser-debuginfo"
        },
        "product_reference": "chromium-browser-debuginfo",
        "relates_to_product_reference": "rhel-6.6.z.extras"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-7939",
      "discovery_date": "2015-01-22T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-6.6.z.extras:chromium-browser-debuginfo"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an \"X-Content-Type-Options: nosniff\" header.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
          "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
        ],
        "known_not_affected": [
          "rhel-6.6.z.extras:chromium-browser-debuginfo"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-7939"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7939"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-7939"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-01-27T18:46:27+00:00",
          "details": "Apply advisory RHSA-2015:0093 as per vendors instructions.",
          "product_ids": [
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2015:0093"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "version": "2.0",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "baseScore": 6.8
          },
          "products": [
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src",
            "rhel-6.6.z.extras:chromium-browser-debuginfo"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6",
            "rhel-6.6.z.extras:chromium-browser-0:40.0.2214.91-1.el6_6.src",
            "rhel-6.6.z.extras:chromium-browser-debuginfo"
          ]
        }
      ],
      "title": "same-origin-bypass in V8"
    }
  ]
}