CVE-2015-1266
published 2015-06-26CVE-2015-1266: content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a…
PriorityP424medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.49%
71.5th percentile
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 43.0.2357.81 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2015-06-30·CVSS 5.0
CVE-2015-1266 [MEDIUM] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
It was discovered that Chromium did not properly consider the scheme when
determining whether a URL is associated with a WebUI SiteInstance. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-2015-1266)
It was discovered that Blink did not properly restrict the creation
context during creation of a DOM wrapper. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to bypass same-origin restrictions. (CVE-2015-1267, CVE-2015-1268)
It was discovered that Chromium did not properly canonicalize DNS hostnames
before comparing to HSTS or HPKP preload entries. An
Red Hat
chromium-browser: Scheme validation error in WebUI
vendor_redhat·2015-06-22·CVSS 5.0
CVE-2015-1266 [MEDIUM] chromium-browser: Scheme validation error in WebUI
chromium-browser: Scheme validation error in WebUI
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
GHSA
GHSA-r47q-gp6w-mwhx: content/browser/webui/content_web_ui_controller_factory
ghsa_unreviewed·2022-05-17
CVE-2015-1266 [MEDIUM] GHSA-r47q-gp6w-mwhx: content/browser/webui/content_web_ui_controller_factory
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
OSV
oxide-qt vulnerabilities
osv·2015-06-30·CVSS 5.0
CVE-2015-1266 [MEDIUM] oxide-qt vulnerabilities
oxide-qt vulnerabilities
It was discovered that Chromium did not properly consider the scheme when
determining whether a URL is associated with a WebUI SiteInstance. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-2015-1266)
It was discovered that Blink did not properly restrict the creation
context during creation of a DOM wrapper. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to bypass same-origin restrictions. (CVE-2015-1267, CVE-2015-1268)
It was discovered that Chromium did not properly canonicalize DNS hostnames
before comparing to HSTS or HPKP preload entries. An attacker could
potentially exploit this to bypass intended
OSV
CVE-2015-1266: content/browser/webui/content_web_ui_controller_factory
osv·2015-06-26·CVSS 5.0
CVE-2015-1266 [MEDIUM] CVE-2015-1266: content/browser/webui/content_web_ui_controller_factory
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00057.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00012.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1188.htmlhttp://www.debian.org/security/2015/dsa-3315http://www.securityfocus.com/bid/75333http://www.securitytracker.com/id/1032731http://www.ubuntu.com/usn/USN-2652-1https://code.google.com/p/chromium/issues/detail?id=464922https://codereview.chromium.org/1129123004/https://security.gentoo.org/glsa/201507-18http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00057.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00012.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1188.htmlhttp://www.debian.org/security/2015/dsa-3315http://www.securityfocus.com/bid/75333http://www.securitytracker.com/id/1032731http://www.ubuntu.com/usn/USN-2652-1https://code.google.com/p/chromium/issues/detail?id=464922https://codereview.chromium.org/1129123004/https://security.gentoo.org/glsa/201507-18
2015-06-26
Published