CVE-2015-1304
HighSummary
The object-observe.js file in Google V8, used in Google Chrome before version 45.0.2454.101, does not properly restrict method calls on access-checked objects. This allows remote attackers to bypass the Same Origin Policy via observe or getNotifier calls.
Risk Assessment
An attacker could exploit this vulnerability to gain access to data from other origins, potentially leading to information theft or other malicious actions.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and ensure adequate protection against attacks.
Other vulnerabilities in Google V8 in Google Chrome
See all- CVE-2015-6771High
In Google V8, used in Google Chrome before version 47.0.2526.73, there is an improper implementation of certain map and filter operations for arrays, which may lead to denial of service (out-of-bounds memory access) or possibly other unspecified impacts via crafted JavaScript code.
- CVE-2014-1716High
The XSS vulnerability in the Runtime_SetPrototype function in Google V8, used in Google Chrome before version 34.0.1847.116, allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
Original NVD description (English source)
object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.