The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade chromium-browser | Dec 14, 2015 | Nov 11, 2015 |
| Freebsd | — | Upgrade chromium-pulseUpgrade chromium-npapiUpgrade chromium | Dec 10, 2025 | Nov 11, 2015 |
| Gentoo Linux | — | Upgrade www-client/chromium. | Oct 30, 2017 | Nov 11, 2015 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Nov 18, 2015 | Nov 10, 2015 |
| Suse | — | Upgrade chromium | Dec 18, 2015 | Nov 11, 2015 |
| Ubuntu | — | Upgrade chromium-browser | Nov 19, 2024 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub