Google Chrome Extended URL Checksum Arbitrary URL Access Vulnerability

Google Chrome is a WEB-based browser. The RuntimeEventRouter::OnExtensionUninstalled function in Google Chrome extensions/browser/api/runtime/runtimeapi.cc checksums URLs for a security vulnerability that allows remote attackers to construct malicious WEB pages that can be accessed at arbitrary...

CVE-2015-1298

The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtimeapi.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to a...

CVE-2015-1298

CVE-2015-1298 affects Google Chrome/Chromium prior to 45.0.2454.85. The vulnerability stems from RuntimeEventRouter::OnExtensionUninstalled not validating that setUninstallURL matches a site URL, allowing a user-assisted attacker to trigger access to an arbitrary URL via a crafted extension that ...