CVE-2015-6755

High

Published: 15/10/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The ContainerNode::parserInsertBefore function in Blink, used in Google Chrome before version 46.0.2490.71, proceeds with a DOM tree insertion in cases where a parent node no longer contains a child node. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

Risk Assessment

Bypassing the Same Origin Policy can lead to serious security breaches, allowing attackers to access user data and perform unauthorized actions in the context of a trusted site.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.

Other vulnerabilities in Google Chrome (przed wersją 46.0.2490.71)

CVE-2015-6762High
The CSSFontFaceSrcValue::fetch function in the CSS implementation in Blink, used in Google Chrome before version 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL. This allows remote web servers to bypass the Same Origin Policy via a redirect.

Original NVD description (English source)

The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.