{"api_version":"1","generated_at":"2026-07-23T10:25:46+00:00","cve":"CVE-2015-1254","urls":{"html":"https://cve.report/CVE-2015-1254","api":"https://cve.report/api/cve/CVE-2015-1254.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-1254","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-1254"},"summary":{"title":"CVE-2015-1254","description":"core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.","state":"PUBLISHED","assigner":"Chrome","published_at":"2015-05-20 10:59:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1032375","name":"http://www.securitytracker.com/id/1032375","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code, Bypass Same-Origin Restrictions, and Spoof URLs - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2015/dsa-3267","name":"http://www.debian.org/security/2015/dsa-3267","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3267-1 chromium-browser","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html","name":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2015:1877-1: moderate: Security update for Chromium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201506-04","name":"https://security.gentoo.org/glsa/201506-04","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chromium: Multiple vulnerabilities (GLSA 201506-04) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html","name":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Object not found!","mime":"text/xml","httpstatus":"404","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/74723","name":"http://www.securityfocus.com/bid/74723","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Prior to 43.0.2357.65 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://code.google.com/p/chromium/issues/detail?id=444927","name":"https://code.google.com/p/chromium/issues/detail?id=444927","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 444927 - \n \n \n chromium -\n \n \n An open-source project to help move the web forward. - \n \n Monorail","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","name":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chrome Releases: Stable Channel Update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision","name":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[blink] Revision 192658","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1254","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1254","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"1254","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1254","vulnerable":"1","versionEndIncluding":"42.0.2311.152","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"chrome","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T04:40:17.089Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"openSUSE-SU-2015:0969","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201506-04"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision"},{"name":"openSUSE-SU-2015:1877","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/74723"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://code.google.com/p/chromium/issues/detail?id=444927"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-05-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T15:57:01.000Z","orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome"},"references":[{"name":"openSUSE-SU-2015:0969","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201506-04"},{"tags":["x_refsource_CONFIRM"],"url":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision"},{"name":"openSUSE-SU-2015:1877","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/74723"},{"tags":["x_refsource_CONFIRM"],"url":"https://code.google.com/p/chromium/issues/detail?id=444927"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2015-1254","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"openSUSE-SU-2015:0969","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"name":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","refsource":"CONFIRM","url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"name":"GLSA-201506-04","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201506-04"},{"name":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision","refsource":"CONFIRM","url":"https://src.chromium.org/viewvc/blink?revision=192658&view=revision"},{"name":"openSUSE-SU-2015:1877","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","refsource":"BID","url":"http://www.securityfocus.com/bid/74723"},{"name":"https://code.google.com/p/chromium/issues/detail?id=444927","refsource":"CONFIRM","url":"https://code.google.com/p/chromium/issues/detail?id=444927"}]}}}},"cveMetadata":{"assignerOrgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","assignerShortName":"Chrome","cveId":"CVE-2015-1254","datePublished":"2015-05-20T10:00:00.000Z","dateReserved":"2015-01-21T00:00:00.000Z","dateUpdated":"2024-08-06T04:40:17.089Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-05-20 10:59:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndIncluding":"42.0.2311.152","matchCriteriaId":"6F238C75-E24A-406F-BEB5-8758C8FE9603"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"1254","Ordinal":"1","Title":"CVE-2015-1254","CVE":"CVE-2015-1254","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"1254","Ordinal":"1","NoteData":"core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.","Type":"Description","Title":"CVE-2015-1254"},{"CveYear":"2015","CveId":"1254","Ordinal":"2","NoteData":"2015-05-20","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"1254","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}