chromedriver Downloads Resources over HTTP

Description

Affected versions of chromedriver insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one.

Recommendation

Update the chromedriver package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.25.2
• Patched version(s): 2.25.2

References

• GHSA-jh5w-6964-x5cf
• CVE-2016-10579
• CWE-311
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• static-server Path Traversal vulnerability - CVE-2023-26152
• Denial of service in http-proxy-middleware - CVE-2024-21536
• chromedriver Command Injection vulnerability - CVE-2023-26156
• parse is vulnerable to prototype pollution - CVE-2025-57324

Tags:

npm

chromedriver