A vulnerability has been reported in Google Chrome, which can be exploited by malicious people to disclose certain system information and conduct cross-site scripting attacks.

The vulnerability is caused due to the improper handling of "ChromeHTML" URIs, which can be exploited to enumerate local files and folders or execute arbitrary HTML and script code in a user's browser session in context of arbitrary websites by tricking the user into clicking a specially crafted link in Internet Explorer.

Successful exploitation requires that Google Chrome is not running and that a victim follows a malicious link in Internet Explorer.

The vulnerability is reported in version 1.0.154.55 and prior.

Solution
Update to version 1.0.154.59.

Provided and/or discovered by
Roi Saltzman, IBM Rational Application Security Research Group

Changelog
Further details available in Customer Area

Original Advisory
http://code.google.com/p/chromium/issues/detail?id=9860

http://googlechromereleases.blogspot.com/2009/04/stable-update-security-fix.html

Deep Links
Links available in Customer Area