CVE-2015-1267: Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context durin...

Security readout for executives and security teams

This is an old Chrome/Blink browser flaw that could let a malicious web page bypass Same Origin Policy protections. That policy normally stops one website from reading or interacting with another site's data. The issue was fixed in Chrome 43.0.2357.130, so current managed browsers should not be exposed. Exposure is most plausible on unmanaged or legacy endpoints running Google Chrome or Chromium-derived distro packages from before the June 2015 vendor updates. Modern auto-updated Chrome installations are unlikely to remain affected, but old embedded kiosks, frozen VDI images, or unsupported Linux desktops should be checked. Treat this as a legacy exposure cleanup item, not an emergency active-exploitation response. Prioritize if the organization still runs old browsers, frozen desktop images, or unmanaged Linux workstations because browser SOP bypasses can undermine web application data isolation. Mitigation focus: Upgrade Chrome or Chromium beyond 43.0.2357.130.; Apply the relevant Linux distribution browser security advisory updates.; Remove unsupported legacy browser builds from managed endpoints..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.