CVE-2015-6785: Google Chrome

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains.

Affected products

• Google Chrome: up to and including 46.0.2490.86

Published 2015-12-06. Last modified 2026-06-17.