CVE-2015-1235

What it actually does

The ContainerNode::parserRemoveChild function in the HTML parser allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.

Why it matters to the business

Attackers could access or manipulate data across website boundaries on outdated browser versions, increasing risk of session hijacking or information leakage until systems are updated.

How an attack unfolds

An attacker creates a malicious webpage embedding a specially crafted IFRAME that triggers the parser flaw during DOM manipulation, causing the browser to incorrectly remove child nodes and violate origin isolation when a victim visits the page.

How to fix it

Upgrade affected Firefox installations on Ubuntu 14.04 LTS to version 49.0+build4-0ubuntu0.14.04.1 or later; apply equivalent updates for any other impacted browser packages.

How to confirm the fix worked

Verify browser version meets or exceeds the fixed release; test SOP enforcement with sample cross-origin IFRAME documents in a controlled environment.

Typical attack path

1. Craft malicious HTML document with IFRAME element targeting parserRemoveChild behavior
2. Host the document on an attacker-controlled domain
3. Lure victims to visit the page via phishing or compromised sites
4. Trigger DOM parsing in affected browser to bypass Same Origin Policy checks

How to detect it

Review historical web server or proxy logs for access to suspicious IFRAME-heavy pages around the time of any known vulnerable browser sessions; no widespread post-exploitation artifacts are typically observable for this client-side issue.

What your security team should do

• Prioritize immediate upgrade of all Firefox instances on Ubuntu 14.04 to the specified fixed version
• Audit and retire any remaining systems still running vulnerable browser releases
• Monitor for end-of-support announcements on legacy Ubuntu releases and plan migrations