CVE-2015-1286

Cross-site scripting (XSS) vulnerability in the
V8ContextNativeHandler::GetModuleSystem function in
extensions/renderer/v8_context_native_handler.cc in Google Chrome before
44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML
by leveraging the lack of a certain V8 context restriction, aka a Blink
“Universal XSS (UXSS).”

Bugs

• <https://code.google.com/p/chromium/issues/detail?id=504011&gt;