CVE-2015-1300: google chrome 7PK - Security Features

Vulnerability summary

CVE-2015-1300 is a medium (CVSS 5.0) 7PK - Security Features vulnerability in google chrome. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.4% of scored vulnerabilities.

Timeline

1. 03-09-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.

• CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.