CVE-2015-1248
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the...
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
Exploit likelihood
What each source reports
NVD Score used
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- Record
CVE-2015-1248- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- Record
CVE-2015-1248- Updated
- 2026-11-02
EUVDEUVD-2015-1389 No score
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- Record
EUVD-2015-1389- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-prgf-rqp7-pmqx No score
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the...
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- Record
GHSA-prgf-rqp7-pmqx- Updated
- 2026-11-02
OSVMGASA-2015-0164 No score
Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser 42.0.2311.90 fixes several security issues, among others a cross-origin-bypass in HTML parser (CVE-2015-1235), a cross-origin-bypass in Blink (CVE-2015-1236), a use-after-free in IPC (CVE-2015-1237), an out-of-bounds write in Skia (CVE-2015-1238), an out-of-bounds read in WebGL (CVE-2015-1240), Tap-Jacking (CVE-2015-1241), type confusion in V8 (CVE-2015-1242), HSTS bypass in WebSockets (CVE-2015-1244), a use-after-free in PDFium (CVE-2015-1245), an out-of-bounds read in Blink (CVE-2015-1246), scheme issues in OpenSearch, (CVE-2015-1247), and a SafeBrowsing bypass (CVE-2015-1248). Also included are various fixes from internal audits, fuzzing and other initiatives (CVE-2015-1249), and multiple vulnerabilities in V8 have been fixed at the tip of the 4.2 branch (currently 4.2.77.14) (CVE-2015-3333).
- Record
MGASA-2015-0164- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1248 No score
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- Record
UBUNTU-CVE-2015-1248- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:8 From an advisory covering 16 CVEs |
before 42.0.2311.90-1~deb8u1, plus listed versions 41.0.2272.118-1 |
42.0.2311.90-1~deb8u1 |
chromium-browser-stableMageia:4 From an advisory covering 14 CVEs |
before 42.0.2311.90-1.mga4 | 42.0.2311.90-1.mga4 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 13 CVEs |
before 0:42.0.2311.90-1.el6_6 | 0:42.0.2311.90-1.el6_6 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 13 CVEs |
before 0:42.0.2311.90-1.el6_6 | 0:42.0.2311.90-1.el6_6 |
chromium-browserUbuntu:14.04:LTS |
before 43.0.2357.81-0ubuntu0.14.04.1.1089, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 8 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.1076 |
43.0.2357.81-0ubuntu0.14.04.1.1089 |
chromiumopenSUSE:Tumbleweed From an advisory covering 719 CVEs |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1248 is a medium vulnerability (CVSS 4.3) in Google Chrome, published April 19, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in chromium-browser 43.0.2357.81-0ubuntu0.14.04.1.1089.
References
rhn.redhat.com/errata/RHSA-2015-0816.html
debian.org/security/2015/dsa-3238
lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
security.gentoo.org/glsa/201506-04
securitytracker.com/id/1032209
Show 194 moreShow less
code.google.com/p/chromium/issues/detail?id=380663
googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
nvd.nist.gov/vuln/detail/CVE-2015-1248
github.com/advisories/GHSA-prgf-rqp7-pmqx
advisories.mageia.org/MGASA-2015-0164.html
bugs.mageia.org/show_bug.cgi?id=15702
access.redhat.com/errata/RHSA-2015:0816
bugzilla.redhat.com/show_bug.cgi?id=1211919
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0816.json
cve.org/CVERecord?id=CVE-2015-1235
ubuntu.com/security/CVE-2015-1248
suse.com/security/cve/CVE-2011-3015
Left out here: 2,199 references. The JSON record has them.