Secunia

Two vulnerabilities have been reported in Google Chrome, which can be exploited by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks.

1) An error in the processing of RSS and Atom feeds can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the user subscribes to a feed where the attacker is able to include unsanitised input to the feed content.

2) An error in the "getSVGDocument" method can be exploited to bypass the Same-Origin-Policy and execute arbitrary HTML and script code in a user's browser session in context of a site hosting an SVG document.

Solution
Upgrade to version 3.0.195.21.

Provided and/or discovered by
1) Inferno, SecureThoughts.com
2) The vendor credits Isaac Dawson.

Changelog
Further details available in Customer Area

Original Advisory
http://googlechromereleases.blogspot.com/

1) http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/

Deep Links
Links available in Customer Area