Vulnerability Details : CVE-2015-1303
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
Vulnerability category: Input validation
Products affected by CVE-2015-1303
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1303
0.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1303
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-1303
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1303
-
http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html
Chrome Releases: Stable Channel UpdateVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00002.html
[security-announce] openSUSE-SU-2015:1876-1: important: Security update
-
http://www.ubuntu.com/usn/USN-2757-1
USN-2757-1: Oxide vulnerabilities | Ubuntu security notices
-
https://codereview.chromium.org/1339023002
Issue 1339023002: Rethrow cross-site exceptions as security errors - Code ReviewVendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1841.html
RHSA-2015:1841 - Security Advisory - Red Hat Customer Portal
-
https://code.google.com/p/chromium/issues/detail?id=530301
530301 - Security: Universal XSS using stack overflow exceptions - chromium - Monorail
-
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00008.html
[security-announce] openSUSE-SU-2015:1719-1: important: Security update
-
https://security.gentoo.org/glsa/201603-09
Chromium: Multiple vulnerabilities (GLSA 201603-09) — Gentoo security
-
http://www.debian.org/security/2015/dsa-3376
Debian -- Security Information -- DSA-3376-1 chromium-browser
-
http://www.securitytracker.com/id/1033683
Google Chrome Lets Remote Users Bypass Cross-Origin Security Restrictions on the Target System - SecurityTracker
-
http://www.securityfocus.com/bid/76844
Google Chrome Prior to 45.0.2454.101 Multiple Cross-Origin Security Bypass Vulnerabilities
Jump to