What’s Vulnerable › Vulnerabilities

CVE-2015-1241

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-04-19 · updated 2026-06-17
• Weakness: CWE-1021

Description

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

Affected products

• Canonical Ubuntu Linux: 14.04, 14.10, 15.04
• Debian Linux: 8.0
• Google Chrome: before 42.0.2311.90 — fixed in 42.0.2311.90
• Opensuse: 13.1, 13.2
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Eus: 6.6
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Server Aus: 6.6
• RedHat Enterprise Linux Server Eus: 6.6
• RedHat Enterprise Linux Workstation: 6.0
• SUSE Linux Enterprise: 12.0

How to fix

Upgrade to a fixed version: Google Chrome 42.0.2311.90. Check the vendor advisory for mitigations.

References

• http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
• http://rhn.redhat.com/errata/RHSA-2015-0816.html
• http://ubuntu.com/usn/usn-2570-1
• http://www.debian.org/security/2015/dsa-3238
• http://www.securitytracker.com/id/1032209
• https://code.google.com/p/chromium/issues/detail?id=418402
• https://codereview.chromium.org/628763003
• https://codereview.chromium.org/660663002
• https://codereview.chromium.org/717573004
• https://codereview.chromium.org/868123002

Get alerted when CVE-2015-1241 or the next vulnerability affects your stack