CVE-2015-1266

content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a…

published June 26, 2015

CVSS
—
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01448 · 73.1th percentile
Published
2015-06-26T14:00Z
EPSS history
Timeline
  • 26 JUN 14:00Z
    content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a…
    cvelistv5