vulnwire
2.1low

CVE-2008-5915

An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a curre…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
2.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 69%
Public exploits
0
none known

An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.

Exploit prediction (EPSS)

1.23% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.02.1AV:N/AC:H/Au:S/C:N/I:P/A:N

Classification

Technology feeds
Google Chrome (RSS, critical only)

References

  • infoworld.com /article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html · x_refsource_MISC, x_transferred
  • darkreading.com /security/attacks/showArticle.jhtml?articleID=212900161 · x_refsource_MISC, x_transferred
  • arstechnica.com /news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html · x_refsource_MISC, x_transferred
  • trusteer.com /files/In-session-phishing-advisory-2.pdf · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/33276 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.