CVE-2015-2239
published 2015-03-09CVE-2015-2239: Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and…
PriorityP417medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.18%
64.6th percentile
Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 40.0.2214.115 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-93hf-6xf6-6286: Google Chrome before 41
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2015-2239 [HIGH] GHSA-93hf-6xf6-6286: Google Chrome before 41
Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
OSV
CVE-2015-2239: Google Chrome before 41
osv·2015-03-09·CVSS 7.5
CVE-2015-2239 [HIGH] CVE-2015-2239: Google Chrome before 41
Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.htmlhttp://www.securityfocus.com/bid/74855https://code.google.com/p/chromium/issues/detail?id=256724https://code.google.com/p/chromium/issues/detail?id=463349http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.htmlhttp://www.securityfocus.com/bid/74855https://code.google.com/p/chromium/issues/detail?id=256724https://code.google.com/p/chromium/issues/detail?id=463349
2015-03-09
Published