CVE-2015-1241

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

• CWE-1021

• http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlRelease Notes
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlMitigation, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.htmlMitigation, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0816.htmlThird Party Advisory
• http://ubuntu.com/usn/usn-2570-1Third Party Advisory
• http://www.debian.org/security/2015/dsa-3238Third Party Advisory
• http://www.securitytracker.com/id/1032209Broken Link, Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=418402Exploit, Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/628763003Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/660663002Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/717573004Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/868123002Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/201506-04Third Party Advisory
• http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlRelease Notes
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlMitigation, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.htmlMitigation, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0816.htmlThird Party Advisory
• http://ubuntu.com/usn/usn-2570-1Third Party Advisory
• http://www.debian.org/security/2015/dsa-3238Third Party Advisory
• http://www.securitytracker.com/id/1032209Broken Link, Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=418402Exploit, Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/628763003Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/660663002Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/717573004Issue Tracking, Vendor Advisory
• https://codereview.chromium.org/868123002Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/201506-04Third Party Advisory

Published

Apr 19, 2015

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1235The ContainerNode::parserRemoveChild function in core/dom/Co…
• CVE-2015-1236The MediaElementAudioSourceNode::process function in modules…
• CVE-2015-1237Use-after-free vulnerability in the RenderFrameImpl::OnMessa…
• CVE-2015-1238Skia, as used in Google Chrome before 42.0.2311.90, allows r…
• CVE-2015-1239Double free vulnerability in the j2k_read_ppm_v3 function in…6.5
• CVE-2015-1240gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implemen…
• CVE-2015-1242The ReduceTransitionElementsKind function in hydrogen-check-…
• CVE-2015-1243Use-after-free vulnerability in the MutationObserver::discon…
• CVE-2015-1244The URLRequest::GetHSTSRedirect function in url_request/url_…
• CVE-2015-1245Use-after-free vulnerability in the OpenPDFInReaderView::Upd…
• CVE-2015-1246Blink, as used in Google Chrome before 42.0.2311.90, allows …
• CVE-2015-1247The SearchEngineTabHelper::OnPageHasOSDD function in browser…