CVE-2015-1303

High

Published: 12/10/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

In Blink, used in Google Chrome before version 45.0.2454.101, there is a vulnerability that does not perform a rethrow action to propagate information about cross-context exceptions. This allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.

Risk Assessment

Organizations may be exposed to attacks that allow access to data from other origins, potentially leading to information theft or other malicious activities.

Recommendation

It is recommended to update Google Chrome to the latest version to protect against this vulnerability.

Other vulnerabilities in Blink in Google Chrome

CVE-2016-5171High
In Blink, used in Google Chrome before version 53.0.2785.113, there is a vulnerability that does not prevent certain constructor calls. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.

Original NVD description (English source)

bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.