Cloudanix VulnDB

CVE-2015-1253

None

CVSS

—

EPSS

1.6%

Published

May 20, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in older web browsers lets attackers on one website secretly access information from another website that should be kept separate.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Web Framework
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw in Blink's HTMLConstructionSite allows crafted JavaScript to append a child to a SCRIPT element, bypassing the Same Origin Policy checks during DOM insertion and reparenting tasks.

Why it matters to the business

Attackers can read or modify data across website boundaries, risking unauthorized access to user sessions, credentials, or sensitive application content on affected browser deployments.

How an attack unfolds

An attacker hosts a malicious webpage that delivers JavaScript exploiting the insert and executeReparentTask functions to inject content into a cross-origin SCRIPT element, violating SOP and enabling data exfiltration or session manipulation in vulnerable Chrome versions.

How to fix it

Upgrade affected packages to the listed fixed versions such as Debian 4.7.8-1, Ubuntu 3.13.0-103.150, 4.4.0-51.72, or 4.8.0-36.36~16.04.1 depending on distribution and flavor; rebuild or replace any embedded Chromium components with patched equivalents.

How to confirm the fix worked

Confirm browser or package version meets or exceeds the fixed releases; test SOP enforcement with proof-of-concept scripts that attempt cross-origin SCRIPT manipulation and verify isolation is enforced.

Typical attack path

  1. Victim visits attacker-controlled site or ad
  2. Malicious JavaScript executes in browser context
  3. Script appends child node to cross-origin SCRIPT element via DOM APIs
  4. Bypass of Same Origin Policy occurs during reparenting
  5. Attacker reads or alters cross-origin resources

How to detect it

Review web server or proxy logs for unusual cross-origin requests originating from untrusted domains; examine browser process telemetry or crash reports for anomalous SCRIPT element manipulations; search historical network captures for JavaScript patterns targeting DOM reparenting.

What your security team should do

  • Prioritize upgrades on any remaining systems using the specified fixed package versions
  • Scan inventories for outdated Chromium or Blink-based applications
  • Monitor for legacy browser usage and enforce auto-update policies
  • Review web applications for reliance on SOP assumptions in legacy client environments

The record

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.

Affected packages

Ecosystem Package Introduced Fixed
Debian:8 chromium-browser 0 43.0.2357.65-1~deb8u1
Mageia:4 chromium-browser-stable 0 43.0.2357.65-1.mga4
Red Hat:rhel_extras:6 chromium-browser 0 0:43.0.2357.65-1.el6_6
Red Hat:rhel_extras:6 chromium-browser-debuginfo 0 0:43.0.2357.65-1.el6_6
Ubuntu:14.04:LTS chromium-browser 0 43.0.2357.81-0ubuntu0.14.04.1.1089
Ubuntu:14.04:LTS oxide-qt 0 1.7.8-0ubuntu0.14.04.1
openSUSE:Tumbleweed chromium 0 55.0.2883.75-3.1
openSUSE:Tumbleweed chromium 0 113.0.5672.92-1.1

Related vulnerabilities