Read the docs
TI-2009-03730 Aliases CVE-2009-3933GHSA-jmx4-fm4w-px4w

WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers…

Priority LOW 28CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions.

Why it matters now

EPSS 0.03105 87th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 45

CPEVersionsRoleVendor
cpe:2.3:a:webkit:webkit:*:*:*:*:*:*:*:*up to r50173VulnerableWebKit
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*up to 3.0.195.24Running onGoogle
cpe:2.3:a:google:chrome:0.2.149.27:*:*:*:*:*:*:*0.2.149.27Running onGoogle
cpe:2.3:a:google:chrome:0.2.149.29:*:*:*:*:*:*:*0.2.149.29Running onGoogle
cpe:2.3:a:google:chrome:0.2.149.30:*:*:*:*:*:*:*0.2.149.30Running onGoogle
cpe:2.3:a:google:chrome:0.2.152.1:*:*:*:*:*:*:*0.2.152.1Running onGoogle
cpe:2.3:a:google:chrome:0.2.153.1:*:*:*:*:*:*:*0.2.153.1Running onGoogle
cpe:2.3:a:google:chrome:0.3.154.0:*:*:*:*:*:*:*0.3.154.0Running onGoogle
cpe:2.3:a:google:chrome:0.3.154.3:*:*:*:*:*:*:*0.3.154.3Running onGoogle
cpe:2.3:a:google:chrome:0.4.154.18:*:*:*:*:*:*:*0.4.154.18Running onGoogle
  • cpe:2.3:a:webkit:webkit:*:*:*:*:*:*:*:* Versions up to r50173 Vulnerable ·WebKit
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* Versions up to 3.0.195.24 Running on ·Google
  • cpe:2.3:a:google:chrome:0.2.149.27:*:*:*:*:*:*:* Versions 0.2.149.27 Running on ·Google
  • cpe:2.3:a:google:chrome:0.2.149.29:*:*:*:*:*:*:* Versions 0.2.149.29 Running on ·Google
  • cpe:2.3:a:google:chrome:0.2.149.30:*:*:*:*:*:*:* Versions 0.2.149.30 Running on ·Google
  • cpe:2.3:a:google:chrome:0.2.152.1:*:*:*:*:*:*:* Versions 0.2.152.1 Running on ·Google
  • cpe:2.3:a:google:chrome:0.2.153.1:*:*:*:*:*:*:* Versions 0.2.153.1 Running on ·Google
  • cpe:2.3:a:google:chrome:0.3.154.0:*:*:*:*:*:*:* Versions 0.3.154.0 Running on ·Google
  • cpe:2.3:a:google:chrome:0.3.154.3:*:*:*:*:*:*:* Versions 0.3.154.3 Running on ·Google
  • cpe:2.3:a:google:chrome:0.4.154.18:*:*:*:*:*:*:* Versions 0.4.154.18 Running on ·Google
Show 35 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:google:chrome:0.4.154.22:*:*:*:*:*:*:*0.4.154.22Running onGoogle
cpe:2.3:a:google:chrome:0.4.154.31:*:*:*:*:*:*:*0.4.154.31Running onGoogle
cpe:2.3:a:google:chrome:0.4.154.33:*:*:*:*:*:*:*0.4.154.33Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.36:*:*:*:*:*:*:*1.0.154.36Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.39:*:*:*:*:*:*:*1.0.154.39Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.42:*:*:*:*:*:*:*1.0.154.42Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.43:*:*:*:*:*:*:*1.0.154.43Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.46:*:*:*:*:*:*:*1.0.154.46Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.48:*:*:*:*:*:*:*1.0.154.48Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.52:*:*:*:*:*:*:*1.0.154.52Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.53:*:*:*:*:*:*:*1.0.154.53Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.59:*:*:*:*:*:*:*1.0.154.59Running onGoogle
cpe:2.3:a:google:chrome:1.0.154.65:*:*:*:*:*:*:*1.0.154.65Running onGoogle
cpe:2.3:a:google:chrome:2.0.156.1:*:*:*:*:*:*:*2.0.156.1Running onGoogle
cpe:2.3:a:google:chrome:2.0.157.0:*:*:*:*:*:*:*2.0.157.0Running onGoogle
cpe:2.3:a:google:chrome:2.0.157.2:*:*:*:*:*:*:*2.0.157.2Running onGoogle
cpe:2.3:a:google:chrome:2.0.158.0:*:*:*:*:*:*:*2.0.158.0Running onGoogle
cpe:2.3:a:google:chrome:2.0.159.0:*:*:*:*:*:*:*2.0.159.0Running onGoogle
cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:*2.0.169.0Running onGoogle
cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:*2.0.169.1Running onGoogle
cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:*2.0.170.0Running onGoogle
cpe:2.3:a:google:chrome:2.0.172:*:*:*:*:*:*:*2.0.172Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:*2.0.172.2Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:*2.0.172.8Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:*2.0.172.27Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:*2.0.172.28Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:*2.0.172.30Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.31:*:*:*:*:*:*:*2.0.172.31Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:*2.0.172.33Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:*2.0.172.37Running onGoogle
cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:*2.0.172.38Running onGoogle
cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:*3.0.182.2Running onGoogle
cpe:2.3:a:google:chrome:3.0.190.2:*:*:*:*:*:*:*3.0.190.2Running onGoogle
cpe:2.3:a:google:chrome:3.0.193.2:beta:*:*:*:*:*:*3.0.193.2 betaRunning onGoogle
cpe:2.3:a:google:chrome:3.0.195.21:*:*:*:*:*:*:*3.0.195.21Running onGoogle
  • cpe:2.3:a:google:chrome:0.4.154.22:*:*:*:*:*:*:* Versions 0.4.154.22 Running on ·Google
  • cpe:2.3:a:google:chrome:0.4.154.31:*:*:*:*:*:*:* Versions 0.4.154.31 Running on ·Google
  • cpe:2.3:a:google:chrome:0.4.154.33:*:*:*:*:*:*:* Versions 0.4.154.33 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.36:*:*:*:*:*:*:* Versions 1.0.154.36 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.39:*:*:*:*:*:*:* Versions 1.0.154.39 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.42:*:*:*:*:*:*:* Versions 1.0.154.42 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.43:*:*:*:*:*:*:* Versions 1.0.154.43 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.46:*:*:*:*:*:*:* Versions 1.0.154.46 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.48:*:*:*:*:*:*:* Versions 1.0.154.48 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.52:*:*:*:*:*:*:* Versions 1.0.154.52 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.53:*:*:*:*:*:*:* Versions 1.0.154.53 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.59:*:*:*:*:*:*:* Versions 1.0.154.59 Running on ·Google
  • cpe:2.3:a:google:chrome:1.0.154.65:*:*:*:*:*:*:* Versions 1.0.154.65 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.156.1:*:*:*:*:*:*:* Versions 2.0.156.1 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.157.0:*:*:*:*:*:*:* Versions 2.0.157.0 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.157.2:*:*:*:*:*:*:* Versions 2.0.157.2 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.158.0:*:*:*:*:*:*:* Versions 2.0.158.0 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.159.0:*:*:*:*:*:*:* Versions 2.0.159.0 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.169.0:*:*:*:*:*:*:* Versions 2.0.169.0 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.169.1:*:*:*:*:*:*:* Versions 2.0.169.1 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.170.0:*:*:*:*:*:*:* Versions 2.0.170.0 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172:*:*:*:*:*:*:* Versions 2.0.172 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.2:*:*:*:*:*:*:* Versions 2.0.172.2 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.8:*:*:*:*:*:*:* Versions 2.0.172.8 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.27:*:*:*:*:*:*:* Versions 2.0.172.27 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.28:*:*:*:*:*:*:* Versions 2.0.172.28 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.30:*:*:*:*:*:*:* Versions 2.0.172.30 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.31:*:*:*:*:*:*:* Versions 2.0.172.31 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.33:*:*:*:*:*:*:* Versions 2.0.172.33 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.37:*:*:*:*:*:*:* Versions 2.0.172.37 Running on ·Google
  • cpe:2.3:a:google:chrome:2.0.172.38:*:*:*:*:*:*:* Versions 2.0.172.38 Running on ·Google
  • cpe:2.3:a:google:chrome:3.0.182.2:*:*:*:*:*:*:* Versions 3.0.182.2 Running on ·Google
  • cpe:2.3:a:google:chrome:3.0.190.2:*:*:*:*:*:*:* Versions 3.0.190.2 Running on ·Google
  • cpe:2.3:a:google:chrome:3.0.193.2:beta:*:*:*:*:*:* Versions 3.0.193.2 beta Running on ·Google
  • cpe:2.3:a:google:chrome:3.0.195.21:*:*:*:*:*:*:* Versions 3.0.195.21 Running on ·Google

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3933
  2. 2026-10-03 Alias added: GHSA-jmx4-fm4w-px4w

References

Patch 1

Advisory 2

Other 7

  • TI-2016-07847 The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service… CVSS 3.0HIGH 7.5
  • TI-2010-01691 Off-by-one error in the WebSocketHandshake::readServerHandshake function in… CVSS 2.0HIGH 7.5
  • TI-2016-07846 JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds… CVSS 3.0MEDIUM 5.5
  • TI-2008-05754 xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences