CVE-2015-1267

Blink, utilizado en Google Chrome anterior a 43.0.2357.130, no restringe correctamente el contexto de la creación durante la creación de un envoltorio DOM, lo que permite a atacantes remotos evadir Same Origin Policy a través de código JavaScript manipulado que utiliza una API pública de Blink, relacionado con WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, y WebDOMFileSystem.cpp.

It was discovered that Chromium did not properly consider the scheme when determining whether a URL is associated with a WebUI SiteInstance. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. It was discovered that Blink did not properly restrict the creation context during creation of a DOM wrapper. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. Various other issues were also addressed.