CVE-2015-6785

The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains.

Affected products

Alt Linux, Google Chrome, Opera, Red Hat, Suse, Ubuntu, Webkit

Google Chrome

≤ 46.0.2490.86

Fix

Available

CVSS 2.0

4.3 MEDIUM

EPSS

1.7% (75th percentile)

Weakness

CWE-264

NVD status

Modified

Published

2015-12-06

No exploit for CVE-2015-6785 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.