CVE-2015-1291: Google Chrome

Medium severity, CVSS 6.4. EPSS: 1.7% chance of exploitation in the next 30 days.

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.

Affected products

• Google Chrome: up to and including 44.0.2403

Published 2015-09-03. Last modified 2026-06-17.