CVE-2015-1286

CWE-79 — Cross-site Scripting (XSS)6 documents6 sources
Severity
4.3MEDIUM
EPSS
0.7%
top 28.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Google ChromeDebian Debian LinuxOpensuse Opensuse+4 more
Timeline
PublishedJul 23
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages5 packages

▶NVDgoogle/chrome43.0.2357.134
▶Ubuntuchromium-browser< 44.0.2403.89-0ubuntu0.14.04.1.1095
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 8.0, Enterprise Linux 6.0, 6.7z

🔴Vulnerability Details

3
GHSA
GHSA-m5gh-3m95-wvqv: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler↗2022-05-14
▶
CVEList
CVE-2015-1286: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler↗2015-07-23
▶
OSV
CVE-2015-1286: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler↗2015-07-23
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: UXSS in blink.↗2015-07-21
▶

💬Community

1
Bugzilla
CVE-2015-1286 chromium-browser: UXSS in blink.↗2015-07-22
▶
CVE-2015-1286 (MEDIUM CVSS 4.3) | Cross-site scripting (XSS) vulnerab | cvebase.io