CVE-2015-1300: Google Chrome

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.

Affected products

• Google Chrome: up to and including 44.0.2403

Published 2015-09-03. Last modified 2026-06-17.