Vulnerability in Google Chrome

CVE-2015-1248

The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.

EPSS: 0.015 (72.5th percentile) — read the EPSS interpretation.

Affected products

Google Chrome
Debian Debian_linux — versions 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

chrome-cve-admin@google.com (x_refsource_REDHAT, vendor-advisory)
chrome-cve-admin@google.com (vendor-advisory, x_refsource_DEBIAN)
chrome-cve-admin@google.com (vendor-advisory, x_refsource_SUSE)
chrome-cve-admin@google.com (vendor-advisory, x_refsource_GENTOO)
chrome-cve-admin@google.com (vdb-entry, x_refsource_SECTRACK)
chrome-cve-admin@google.com (vendor-advisory, x_refsource_SUSE)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (x_refsource_CONFIRM)