{"api_version":"1","generated_at":"2026-07-23T08:11:22+00:00","cve":"CVE-2015-1236","urls":{"html":"https://cve.report/CVE-2015-1236","api":"https://cve.report/api/cve/CVE-2015-1236.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-1236","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-1236"},"summary":{"title":"CVE-2015-1236","description":"The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.","state":"PUBLISHED","assigner":"Chrome","published_at":"2015-04-19 10:59:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3238","name":"http://www.debian.org/security/2015/dsa-3238","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3238-1 chromium-browser","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://ubuntu.com/usn/usn-2570-1","name":"http://ubuntu.com/usn/usn-2570-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-2570-1: Oxide vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html","name":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chrome Releases: Stable Channel Update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201506-04","name":"https://security.gentoo.org/glsa/201506-04","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chromium: Multiple vulnerabilities (GLSA 201506-04) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision","name":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[blink] Revision 189527","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0816.html","name":"http://rhn.redhat.com/errata/RHSA-2015-0816.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://code.google.com/p/chromium/issues/detail?id=313939","name":"https://code.google.com/p/chromium/issues/detail?id=313939","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 313939 - \n chromium -\n \n Security: Cross-origin information disclosure through createMediaElementSource and OfflineAudioContext - \n An open-source project to help move the web forward. - Google Project Hosting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html","name":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2015:1887-1: moderate: Security update for chromium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032209","name":"http://www.securitytracker.com/id/1032209","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, and Bypass Same-Origin Restrictions - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html","name":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2015:0748-1: moderate: Security update for Chromium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1236","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1236","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"1236","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"14.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1236","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"14.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1236","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"15.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1236","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1236","vulnerable":"1","versionEndIncluding":"42.0.2311.60","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"chrome","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T04:33:20.871Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2015:0816","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0816.html"},{"name":"USN-2570-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://ubuntu.com/usn/usn-2570-1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision"},{"name":"DSA-3238","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3238"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://code.google.com/p/chromium/issues/detail?id=313939"},{"name":"openSUSE-SU-2015:1887","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201506-04"},{"name":"1032209","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032209"},{"name":"openSUSE-SU-2015:0748","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-04-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T16:57:01.000Z","orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome"},"references":[{"name":"RHSA-2015:0816","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2015-0816.html"},{"name":"USN-2570-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://ubuntu.com/usn/usn-2570-1"},{"tags":["x_refsource_CONFIRM"],"url":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision"},{"name":"DSA-3238","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3238"},{"tags":["x_refsource_CONFIRM"],"url":"https://code.google.com/p/chromium/issues/detail?id=313939"},{"name":"openSUSE-SU-2015:1887","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201506-04"},{"name":"1032209","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032209"},{"name":"openSUSE-SU-2015:0748","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2015-1236","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"RHSA-2015:0816","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2015-0816.html"},{"name":"USN-2570-1","refsource":"UBUNTU","url":"http://ubuntu.com/usn/usn-2570-1"},{"name":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision","refsource":"CONFIRM","url":"https://src.chromium.org/viewvc/blink?revision=189527&view=revision"},{"name":"DSA-3238","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3238"},{"name":"https://code.google.com/p/chromium/issues/detail?id=313939","refsource":"CONFIRM","url":"https://code.google.com/p/chromium/issues/detail?id=313939"},{"name":"openSUSE-SU-2015:1887","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html"},{"name":"GLSA-201506-04","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201506-04"},{"name":"1032209","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032209"},{"name":"openSUSE-SU-2015:0748","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html"},{"name":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html","refsource":"CONFIRM","url":"http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html"}]}}}},"cveMetadata":{"assignerOrgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","assignerShortName":"Chrome","cveId":"CVE-2015-1236","datePublished":"2015-04-19T10:00:00.000Z","dateReserved":"2015-01-21T00:00:00.000Z","dateUpdated":"2024-08-06T04:33:20.871Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-04-19 10:59:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndIncluding":"42.0.2311.60","matchCriteriaId":"6E0156CA-6A9D-4E00-AF48-14636FA05772"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*","matchCriteriaId":"49A63F39-30BE-443F-AF10-6245587D3359"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*","matchCriteriaId":"F38D3B7E-8429-473F-BB31-FC3583EE5A5B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"1236","Ordinal":"1","Title":"CVE-2015-1236","CVE":"CVE-2015-1236","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"1236","Ordinal":"1","NoteData":"The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.","Type":"Description","Title":"CVE-2015-1236"},{"CveYear":"2015","CveId":"1236","Ordinal":"2","NoteData":"2015-04-19","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"1236","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}