CVE-2015-1156

Published: May 8, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.

Affected (21)

Products: Apple: Iphone Os, Safari

Apple

2 products

Iphone Os

Safari

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 8.3

Configuration B

20 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 6.2.5
Apple Safari	Version 7.0.1
Apple Safari	Version 7.0.2
Apple Safari	Version 7.0.3
Apple Safari	Version 7.0.4
Apple Safari	Version 7.0.5
Apple Safari	Version 7.0.6
Apple Safari	Version 7.0
Apple Safari	Version 7.1.0
Apple Safari	Version 7.1.1
Apple Safari	Version 7.1.2
Apple Safari	Version 7.1.3
Apple Safari	Version 7.1.4
Apple Safari	Version 7.1.5
Apple Safari	Version 8.0.0
Apple Safari	Version 8.0.1
Apple Safari	Version 8.0.2
Apple Safari	Version 8.0.3
Apple Safari	Version 8.0.4
Apple Safari	Version 8.0.5