CVE-2015-1296

The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK…

published September 3, 2015

CVSS
—
EPSS
1%
Percentile
73.4
In the wild
Unconfirmed
What it is

The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01472 · 73.4th percentile
Published
2015-09-03T22:00Z
EPSS history
Timeline
  • 03 SEP 22:00Z
    The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK…
    cvelistv5