CVE-2015-1241

Published: Apr 19, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

Affected (14)

Products: Google: Chrome · Debian: Debian Linux · Canonical: Ubuntu Linux · +3 more

Show all products

Google: Chrome · Debian: Debian Linux · Canonical: Ubuntu Linux · Opensuse: Opensuse · Suse: Linux Enterprise · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation

1 product

1 product

1 product

1 product

1 product

Linux Enterprise

6 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 42.0.2311.90

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.04

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise	Version 12.0

Configuration F

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Eus	Version 6.6
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server Aus	Version 6.6
Redhat Enterprise Linux Server Eus	Version 6.6
Redhat Enterprise Linux Workstation	Version 6.0

Related CWEs

Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

References (26)

http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html

Source: chrome-cve-admin@google.com

Release Notes

http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html

Source: chrome-cve-admin@google.com

MitigationThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html

Source: chrome-cve-admin@google.com

MitigationThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0816.html

Source: chrome-cve-admin@google.com

Third Party Advisory

http://ubuntu.com/usn/usn-2570-1

Source: chrome-cve-admin@google.com

Third Party Advisory

http://www.debian.org/security/2015/dsa-3238

Source: chrome-cve-admin@google.com

Third Party Advisory

http://www.securitytracker.com/id/1032209

Source: chrome-cve-admin@google.com

Broken LinkThird Party AdvisoryVDB Entry

https://code.google.com/p/chromium/issues/detail?id=418402

Source: chrome-cve-admin@google.com

ExploitIssue TrackingVendor Advisory

https://codereview.chromium.org/628763003

Source: chrome-cve-admin@google.com

Issue TrackingVendor Advisory

https://codereview.chromium.org/660663002

Source: chrome-cve-admin@google.com

Issue TrackingVendor Advisory

https://codereview.chromium.org/717573004

Source: chrome-cve-admin@google.com

Issue TrackingVendor Advisory

https://codereview.chromium.org/868123002

Source: chrome-cve-admin@google.com

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/201506-04

Source: chrome-cve-admin@google.com

Third Party Advisory

http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0816.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://ubuntu.com/usn/usn-2570-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3238

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securitytracker.com/id/1032209

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://code.google.com/p/chromium/issues/detail?id=418402

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingVendor Advisory

https://codereview.chromium.org/628763003

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://codereview.chromium.org/660663002

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://codereview.chromium.org/717573004

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://codereview.chromium.org/868123002

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/201506-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.