VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 23, 2015· Updated Jun 17, 2026

CVE-2015-1284

CVE-2015-1284

Description

The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • Google/Chrome2 versions
    cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*range: <=43.0.2357.134
    • (no CPE)range: <44.0.2403.89
  • OpenSUSE/openSUSE2 versions
    cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Workstation Supplementary2 versions
    cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server Supplementary2 versions
    cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.7.z:*:*:*:*:*:*:*
  • osv-coords
    pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed
    Range: < 55.0.2883.75-3.1

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.