CVE-2009-2352: Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses,...

Security readout for executives and security teams

This is an old Google Chrome browser flaw where certain Refresh response headers could cause script execution instead of being blocked. If a vulnerable Chrome user visited or was redirected through attacker-influenced content, the issue could enable cross-site scripting. The public bundle does not provide a CVSS score, confirmed exploitation, or a named vendor fix. Exposure is likely limited to environments still running very old Chrome builds, legacy kiosk images, frozen VDI templates, or archived test systems. Modern Chrome deployments are not identified as affected in the provided sources. Treat as a legacy exposure cleanup item unless affected Chrome versions are still in use. If legacy browsers remain in operational systems, prioritize removal because browser XSS flaws can undermine user sessions and trusted web workflows. Mitigation focus: Inventory endpoints for the named legacy Chrome versions.; Remove or upgrade unsupported Chrome builds from managed environments.; Review vendor guidance for historical Chrome security updates..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.