CVE-2015-3753 is a Same Origin Policy bypass vulnerability in WebKit, affecting Apple Safari versions before 6.2.8, 7.1.8, and 8.0.8, as well as iOS before 8.4.1. This flaw allows remote attackers to obtain sensitive image data from CANVAS elements by leveraging a redirect to a data:image resource due to improper taint checking. With a CVSS score of 5.0 (medium severity), it requires no authentication and has low attack complexity, but only impacts confidentiality. There is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion, with only one Reddit mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.0, < 6.2.8CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
>= 7.0, < 7.1.8CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
>= 8.0, < 8.0.8CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
< 8.4.1CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.