CVE-2015-1261
published 2015-05-20CVE-2015-1261: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.42%
70.3th percentile
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| chrome | <= 42.0.2311.107 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: URL bar spoofing in unspecified component
vendor_redhat·2015-05-19·CVSS 5.0
CVE-2015-1261 [MEDIUM] chromium-browser: URL bar spoofing in unspecified component
chromium-browser: URL bar spoofing in unspecified component
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
GHSA
GHSA-7q7r-w4pq-v5q2: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup
ghsa_unreviewed·2022-05-17
CVE-2015-1261 [MEDIUM] CWE-20 GHSA-7q7r-w4pq-v5q2: android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.htmlhttp://lists.opensuse.org/opensuse-updates/2015-05/msg00091.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00015.htmlhttp://www.debian.org/security/2015/dsa-3267http://www.securityfocus.com/bid/74723http://www.securitytracker.com/id/1032375https://code.google.com/p/chromium/issues/detail?id=466351https://codereview.chromium.org/1011383005https://codereview.chromium.org/1056743002https://codereview.chromium.org/1077483002http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.htmlhttp://lists.opensuse.org/opensuse-updates/2015-05/msg00091.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00015.htmlhttp://www.debian.org/security/2015/dsa-3267http://www.securityfocus.com/bid/74723http://www.securitytracker.com/id/1032375https://code.google.com/p/chromium/issues/detail?id=466351https://codereview.chromium.org/1011383005https://codereview.chromium.org/1056743002https://codereview.chromium.org/1077483002
2015-05-20
Published