Vulnerability Database

299,749

Total vulnerabilities in the database

CVE-2015-1156

The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.

  • Published: May 8, 2015
  • Updated: Nov 9, 2025
  • CVE: CVE-2015-1156
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

Software From Fixed in
apple / iphone_os - 8.3.x
apple / safari 7.0.1 7.0.1.x
apple / safari 8.0.2 8.0.2.x
apple / safari 8.0.1 8.0.1.x
apple / safari 7.0.3 7.0.3.x
apple / safari 7.0.4 7.0.4.x
apple / safari 7.1.0 7.1.0.x
apple / safari 8.0.0 8.0.0.x
apple / safari 7.0.5 7.0.5.x
apple / safari 7.1.5 7.1.5.x
apple / safari 7.0.6 7.0.6.x
apple / safari 7.1.3 7.1.3.x
apple / safari 7.1.1 7.1.1.x
apple / safari 7.0 7.0.x
apple / safari 7.1.4 7.1.4.x
apple / safari 8.0.3 8.0.3.x
apple / safari 8.0.5 8.0.5.x
apple / safari - 6.2.5.x
apple / safari 8.0.4 8.0.4.x
apple / safari 7.1.2 7.1.2.x
apple / safari 7.0.2 7.0.2.x