CVE-2015-1296
published 2015-09-03CVE-2015-1296: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK…
PriorityP422medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.47%
71.2th percentile
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 44.0.2403 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4mrf-6r9m-9mcm: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape
ghsa_unreviewed·2022-05-17
CVE-2015-1296 [MEDIUM] GHSA-4mrf-6r9m-9mcm: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
OSV
CVE-2015-1296: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape
osv·2015-09-03·CVSS 5.0
CVE-2015-1296 [MEDIUM] CVE-2015-1296: The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Red Hat
chromium-browser: Character spoofing in omnibox
vendor_redhat·2015-09-01·CVSS 5.0
CVE-2015-1296 [MEDIUM] chromium-browser: Character spoofing in omnibox
chromium-browser: Character spoofing in omnibox
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.htmlhttp://lists.opensuse.org/opensuse-updates/2015-09/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00013.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1712.htmlhttp://www.debian.org/security/2015/dsa-3351http://www.securitytracker.com/id/1033472https://code.google.com/p/chromium/issues/detail?id=421332https://codereview.chromium.org/1180393003/https://codereview.chromium.org/1189553002/https://security.gentoo.org/glsa/201603-09http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.htmlhttp://lists.opensuse.org/opensuse-updates/2015-09/msg00029.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00013.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1712.htmlhttp://www.debian.org/security/2015/dsa-3351http://www.securitytracker.com/id/1033472https://code.google.com/p/chromium/issues/detail?id=421332https://codereview.chromium.org/1180393003/https://codereview.chromium.org/1189553002/https://security.gentoo.org/glsa/201603-09
2015-09-03
Published