CVE-2015-3334

browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited.

• CWE-17

• http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlRelease Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3238Third Party Advisory
• http://www.securityfocus.com/bid/74225Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=433170Exploit, Vendor Advisory
• http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlRelease Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3238Third Party Advisory
• http://www.securityfocus.com/bid/74225Third Party Advisory, VDB Entry
• https://code.google.com/p/chromium/issues/detail?id=433170Exploit, Vendor Advisory

Published

Apr 19, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3326Trend Micro ScanMail for Microsoft Exchange (SMEX) 10.2 befo…
• CVE-2015-3329Multiple stack-based buffer overflows in the phar_set_inode …
• CVE-2015-3330The php_handler function in sapi/apache2handler/sapi_apache2…
• CVE-2015-3331The __driver_rfc4106_decrypt function in arch/x86/crypto/aes…
• CVE-2015-3332A certain backport in the TCP Fast Open implementation for t…
• CVE-2015-3333Multiple unspecified vulnerabilities in Google V8 before 4.2…
• CVE-2015-3335The NaClSandbox::InitializeLayerTwoSandbox function in compo…
• CVE-2015-3336Google Chrome before 42.0.2311.90 does not always ask the us…
• CVE-2015-3337Directory traversal vulnerability in Elasticsearch before 1.…
• CVE-2015-3339Race condition in the prepare_binprm function in fs/exec.c i…
• CVE-2015-3340Xen 4.2.x through 4.5.x does not initialize certain fields, …
• CVE-2015-3342Open redirect vulnerability in the Ubercart Currency Convers…