Vulnerability · NVD

CVE-2015-1300

CVE-2015-1300, Severity pending severity (CVSS —): 2 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS): -
Exploitation: 1.7 %
Tracked apps: 2
Still exposed: 0

Published on 2015-09-03

The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.

EPSS 1.75% above median percentile 76.2%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Chrome macOS com.google.Chrome

Affected ≤44.0.2403 Fixed in > 44.0.2403 Latest tracked - undetermined
Google Chrome Windows winget:Google.Chrome

Affected ≤44.0.2403 Fixed in > 44.0.2403 Latest tracked 152.0.7977.65 patched

Vulnerable CPE configurations (2)

Vendor	Product	Platform	Versions	CPE 2.3 URI
google	chrome All platforms (wildcard)	All platforms (wildcard)	≤44.0.2403	cpe:2.3:a:google:chrome::::::::
google	chrome All platforms (wildcard)	All platforms (wildcard)	≤44.0.2403	cpe:2.3:a:google:chrome::::::::

View on NVD ↗