CVE-2015-1254 — Incorrect Comparison Logic Granularity in Google Chrome

CWE-264CWE-1254 — Incorrect Comparison Logic GranularityCWE-670 — Always-Incorrect Control Flow Implementation8 documents7 sources
Severity
5.0MEDIUMNVD
OSV7.5
EPSS
1.4%
top 19.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeDebian Linux
Timeline
PublishedMay 20
Latest updateMay 17

Description

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome42.0.2311.152

Also affects: Debian Linux 8.0

🔴Vulnerability Details

4
GHSA
GHSA-4j9x-vhq3-45pr: core/dom/Document↗2022-05-17
▶
GHSA
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js↗2017-10-24
▶
OSV
oxide-qt vulnerabilities↗2015-05-21
▶
OSV
CVE-2015-1254: core/dom/Document↗2015-05-20
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2015-05-21
▶
Red Hat
chromium-browser: Cross-origin bypass in Editing.↗2015-05-19
▶

💬Community

1
Bugzilla
CVE-2015-1254 chromium-browser: Cross-origin bypass in Editing.↗2015-05-20
▶