Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Google Chrome Content Security Policy 权限许可和访问控制漏洞
Vulnerability Description
Google Chrome是美国谷歌（Google）公司开发的一款Web浏览器。 Google Chrome 47.0.2526.73之前版本的Content Security Policy(CSP)实现过程中的WebKit/Source/core/frame/csp/CSPSourceList.cpp文件中的‘CSPSourceList::matches’函数存在安全漏洞，该漏洞源于程序允许使用‘*’资源通配符与blob:，data:或filesystem: URL相匹配。远程攻击者可借助特制的策略利用
CVSS Information
N/A
Vulnerability Type
N/A