Unrated severityNVD Advisory· Published May 20, 2015· Updated Jun 17, 2026

CVE-2015-1254

Description

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Chrome2 versions
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*range: <=42.0.2311.152
- (no CPE)range: <43.0.2357.65
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
osv-coords
pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed
Range: < 55.0.2883.75-3.1

Patches

Vulnerability mechanics

References

googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.htmlnvd
lists.opensuse.org/opensuse-updates/2015-05/msg00091.htmlnvd
lists.opensuse.org/opensuse-updates/2015-11/msg00015.htmlnvd
www.debian.org/security/2015/dsa-3267nvd
www.securityfocus.com/bid/74723nvd
www.securitytracker.com/id/1032375nvd
code.google.com/p/chromium/issues/detailnvd
security.gentoo.org/glsa/201506-04nvd
src.chromium.org/viewvc/blinknvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000