CVE-2015-1298 — Google Chrome vulnerability

CWE-2547 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.8%
top 25.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedSep 3
Latest updateMay 17

Description

The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome44.0.2403

🔴Vulnerability Details

2
GHSA
GHSA-jfr3-3w58-fvcc: The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api↗2022-05-17
▶
OSV
CVE-2015-1298: The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api↗2015-09-03
▶

📋Vendor Advisories

2
Red Hat
chromium-browser: URL validation error in extensions↗2015-09-01
▶
Red Hat
webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)↗2015-01-26
▶

💬Community

2
Bugzilla
CVE-2015-1298 chromium-browser: URL validation error in extensions↗2015-09-02
▶
Bugzilla
CVE-2014-1298 webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)↗2015-01-27
▶