CVE-2015-1253
HighSummary
In the DOM implementation in Blink, used in Google Chrome before version 43.0.2357.65, there is a vulnerability that allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element.
Risk Assessment
Attackers can exploit this vulnerability to execute unauthorized code in the context of a trusted site, potentially leading to data theft or other malicious actions.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.
Other vulnerabilities in Blink (DOM implementation in Google Chrome)
See all- CVE-2015-1293High
The DOM implementation in Blink, used in Google Chrome before version 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
- CVE-2014-7930High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
- CVE-2014-3169High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
- CVE-2014-1731High
The DOM implementation in Blink, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, has an issue with improper renderer state checking upon a focus event. This can lead to denial of service or other unspecified impacts via vectors leveraging 'type confusion' for SELECT elements.
Original NVD description (English source)
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.