CVE-2015-6786: Google Chrome

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern.

Affected products

• Google Chrome: up to and including 46.0.2490.86

Published 2015-12-06. Last modified 2026-06-17.