Vulnetix
Try Vulnetix Request Demo
CVE-2015-6762 PUBLISHED

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.

EPSS 0.70% · 71.8th percentile

Risk Scores

EPSS Score
0.70%
71.8th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSoxide-qt1.9.5-0ubuntu0.14.04.1, 1.0.0~bzr475-0ubuntu1, 1.0.0~bzr490-0ubuntu1
Ubuntu:14.04:LTSchromium-browser29.0.1547.65-0ubuntu2, 31.0.1650.63-0ubuntu1~20131204.1, 32.0.1700.107-0ubuntu1~20140204.977.1

Timeline

References

Open in Interactive Console →