cve/2015/CVE-2015-1268.md

CVE-2015-1268

Description

bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.

POC

Reference

No PoCs from references.

Github

• https://github.com/0xR0/uxss-db
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Metnew/uxss-db
• https://github.com/lnick2023/nicenice
• https://github.com/qazbnm456/awesome-cve-poc
• https://github.com/xbl3/awesome-cve-poc_qazbnm456