CVE-2015-1284

CVE-2015-1284 describes a denial-of-service vulnerability in the Blink rendering engine, specifically within the LocalFrame::isURLAllowed function. This flaw, affecting Google Chrome versions prior to 44.0.2403.89, as well as OpenSUSE and Red Hat products, stems from improper checking of a page's maximum frame count. An attacker could exploit this by crafting JavaScript to create numerous IFRAME elements, leading to an invalid count value, use-after-free, and a denial of service. The vulnerability carries a CVSS score of 7.5, indicating high severity. It is remotely exploitable with low attack complexity, potentially leading to partial confidentiality, integrity, and availability impacts. While the EPSS score is low, suggesting a low likelihood of exploitation, its FAUCET Risk Score is 54/100. Currently, there is no evidence of active exploitation, and no exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Despite this, the CVE has garnered some community attention with two mentions and two media articles, indicating it was noted by security researchers and news outlets at the time of its disclosure.