CVE-2015-1296
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before...
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Exploit likelihood
What each source reports
NVD Score used
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
- Record
CVE-2015-1296- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
- Record
CVE-2015-1296- Updated
- 2026-11-02
EUVDEUVD-2015-1437 No score
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
- Record
EUVD-2015-1437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4mrf-6r9m-9mcm No score
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before...
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
- Record
GHSA-4mrf-6r9m-9mcm- Updated
- 2026-11-02
OSVMGASA-2015-0356 No score
Updated chromium-browser packages fix security vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities:
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium (CVE-2015-1291, CVE-2015-1292, CVE-2015-1293, CVE-2015-1294, CVE-2015-1295, CVE-2015-1296, CVE-2015-1297, CVE-2015-1298, CVE-2015-1299, CVE-2015-1300, CVE-2015-1301).
- Record
MGASA-2015-0356- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1296 No score
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
- Record
UBUNTU-CVE-2015-1296- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:8 From an advisory covering 11 CVEs |
before 45.0.2454.85-1~deb8u1, plus listed versions 41.0.2272.118-142.0.2311.135-142.0.2311.135-1~deb8u142.0.2311.135-242.0.2311.90-1 Show 14 moreShow less42.0.2311.90-1~deb8u142.0.2311.90-243.0.2357.124-143.0.2357.124-243.0.2357.124-343.0.2357.130-143.0.2357.65-143.0.2357.65-1~deb8u143.0.2357.81-144.0.2403.107-144.0.2403.107-244.0.2403.157-144.0.2403.89-144.0.2403.89-1~deb8u1 |
45.0.2454.85-1~deb8u1 |
chromium-browser-stableMageia:4 From an advisory covering 11 CVEs |
before 45.0.2454.85-1.mga4 | 45.0.2454.85-1.mga4 |
chromium-browser-stableMageia:5 From an advisory covering 11 CVEs |
before 45.0.2454.85-1.mga5 | 45.0.2454.85-1.mga5 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 11 CVEs |
before 0:45.0.2454.85-2.el6 | 0:45.0.2454.85-2.el6 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 11 CVEs |
before 0:45.0.2454.85-2.el6 | 0:45.0.2454.85-2.el6 |
chromium-browserUbuntu:14.04:LTS |
before 45.0.2454.85-0ubuntu0.14.04.1.1097, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 11 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.1095 |
45.0.2454.85-0ubuntu0.14.04.1.1097 |
chromiumopenSUSE:Tumbleweed From an advisory covering 719 CVEs |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1296 is a medium vulnerability (CVSS 5.0) in Google Chrome, published September 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in chromium-browser 45.0.2454.85-0ubuntu0.14.04.1.1097.
References
lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
googlechromereleases.blogspot.com/2015/09/stable-channel-update.html
code.google.com/p/chromium/issues/detail?id=421332
rhn.redhat.com/errata/RHSA-2015-1712.html
securitytracker.com/id/1033472
Show 194 moreShow less
codereview.chromium.org/1189553002
debian.org/security/2015/dsa-3351
security.gentoo.org/glsa/201603-09
nvd.nist.gov/vuln/detail/CVE-2015-1296
github.com/advisories/GHSA-4mrf-6r9m-9mcm
advisories.mageia.org/MGASA-2015-0356.html
bugs.mageia.org/show_bug.cgi?id=16688
access.redhat.com/errata/RHSA-2015:1712
bugzilla.redhat.com/show_bug.cgi?id=1259141
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1712.json
cve.org/CVERecord?id=CVE-2015-1291
ubuntu.com/security/CVE-2015-1296
googlechromereleases.blogspot.ca/2015/09/stable-channel-update.html
suse.com/security/cve/CVE-2011-3015
Left out here: 2,198 references. The JSON record has them.