CVE-2015-1266

What it actually does

Failure to validate URL scheme when mapping requests to WebUI SiteInstance objects permits an http:// URL to be treated identically to its chrome:// counterpart, bypassing intended access controls on privileged interfaces.

Why it matters to the business

Attackers can reach internal diagnostic or configuration pages that should be restricted, potentially exposing sensitive browser internals or enabling further client-side attacks with minimal effort; the issue affects a widely deployed browser and has been public for over a decade with no ransomware or KEV usage observed.

How an attack unfolds

An attacker crafts a URL that substitutes the http scheme for the expected chrome:// scheme (e.g., http://gpu) and delivers it to a victim; because the scheme check is absent, the browser associates the request with the WebUI handler and grants access that should have been denied.

How to fix it

Upgrade affected Chrome installations to version 43.0.2357.130 or later. For the listed piwigo/piwigo (GIT) packages apply the commit 4b33a0fd199fd445b15a49927ea6a9a153e3877d. Verify the scheme validation logic is present after the update.

How to confirm the fix worked

Confirm the browser version is at least 43.0.2357.130, then attempt to load both chrome://gpu and http://gpu; the http variant must be rejected or redirected after the fix.

Typical attack path

1. Identify a WebUI handler that enforces access restrictions based on chrome:// scheme
2. Construct an equivalent http:// URL that matches the handler path
3. Deliver the URL to a target user via phishing or malicious site
4. Victim browser loads the URL and grants unintended access to the WebUI class

How to detect it

Search browser history, proxy logs, and web server logs for requests to http:// variants of known chrome:// paths such as gpu, settings, or extensions; correlate with user reports of unexpected access to diagnostic pages.

What your security team should do

• Prioritize patching all Chrome instances to 43.0.2357.130+ within standard change windows
• Add browser version checks to endpoint compliance scans
• Review any internal tools that embed or render chrome:// URLs for similar scheme assumptions