CVEvulnerability
CVE-2015-1241
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-04-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-1021
Description
Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.
Affected configurations
• google chrome (< 42.0.2311.90)
• debian debian linux 8.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.04
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• suse linux enterprise 12.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux eus 6.6
• redhat enterprise linux server 6.0
• redhat enterprise linux server aus 6.6
• redhat enterprise linux server eus 6.6
• redhat enterprise linux workstation 6.0
Related
Weakness · CWE (1)
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness
Referenced by CWE · observed example (1)
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness
References
- http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html Release Notes
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html Mitigation, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html Mitigation, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0816.html Third Party Advisory
- http://ubuntu.com/usn/usn-2570-1 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3238 Third Party Advisory
- http://www.securitytracker.com/id/1032209 Broken Link, Third Party Advisory, VDB Entry
- https://code.google.com/p/chromium/issues/detail?id=418402 Exploit, Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/628763003 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/660663002 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/717573004 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/868123002 Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201506-04 Third Party Advisory
- http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html Release Notes
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html Mitigation, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html Mitigation, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0816.html Third Party Advisory
- http://ubuntu.com/usn/usn-2570-1 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3238 Third Party Advisory
- http://www.securitytracker.com/id/1032209 Broken Link, Third Party Advisory, VDB Entry
- https://code.google.com/p/chromium/issues/detail?id=418402 Exploit, Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/628763003 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/660663002 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/717573004 Issue Tracking, Vendor Advisory
- https://codereview.chromium.org/868123002 Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201506-04 Third Party Advisory