CVE-2012-5851: html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does...

Security readout for executives and security teams

This CVE describes a bypass of WebKit’s browser-side XSS Auditor protection in older Chrome and Safari versions. A malicious site or link could make reflected script content slip past that protection. The sources do not provide a CVSS score, named patch version, or evidence of active exploitation. Exposure is mainly legacy client-side: users running Google Chrome through 22, Safari 5.1.7, or WebKit builds carrying the affected XSSAuditor behavior. Modern environments are less likely exposed, but embedded or unmanaged legacy browsers should be checked. Treat this as a legacy technology risk. It is not KEV-listed in the supplied data, but any remaining affected browsers represent unsupported client exposure and should be removed through normal endpoint hygiene. Mitigation focus: Inventory Chrome, Safari, and embedded WebKit versions in managed environments.; Retire or upgrade Chrome through 22 and Safari 5.1.7 where found.; Check current vendor guidance for fixed WebKit, Chrome, or Safari builds..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.