CVE-2015-6755

What it actually does

The flaw in Blink's ContainerNode::parserInsertBefore allows a DOM node insertion to proceed even after the parent has lost the target child, bypassing Same Origin Policy enforcement on cross-origin access.

Why it matters to the business

Attackers can read or modify data belonging to other origins, enabling theft of credentials, session tokens, or sensitive content displayed in the browser, with high urgency for any remaining unpatched Chrome instances from 2015.

How an attack unfolds

An attacker serves crafted JavaScript that triggers parserInsertBefore during DOM manipulation in a way that violates the parent-child relationship check, allowing subsequent cross-origin reads or writes that the browser should have blocked.

How to fix it

Upgrade Google Chrome to version 46.0.2490.71 or later; ensure automatic updates are enabled and audit any pinned older builds across the fleet.

How to confirm the fix worked

Verify installed Chrome version is 46.0.2490.71 or newer via chrome://version or enterprise management console; re-test affected DOM insertion scenarios with Same Origin Policy test cases.

Typical attack path

1. Serve malicious JavaScript from attacker-controlled origin
2. Trigger parserInsertBefore via DOM operations that remove a child node mid-insertion
3. Bypass SOP checks to access or modify objects from a different origin
4. Exfiltrate sensitive data or perform unauthorized actions in the victim's session

How to detect it

Search browser telemetry, proxy logs, or endpoint process inventories for Chrome versions prior to 46.0.2490.71; review historical web request logs for unusual cross-origin JavaScript activity patterns from that era.

What your security team should do

• Immediately inventory and replace any Chrome instances older than 46.0.2490.71
• Enforce browser auto-update policies and block legacy versions via enterprise controls
• Monitor for any remaining 2015-era browser usage in high-risk environments