CVE-2015-6779 in Chrome
Summary
by MITRE
PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/28/2022
CVE-2015-6779 represents a critical security vulnerability in PDFium, the PDF rendering engine used by Google Chrome and other applications. This flaw stems from inadequate validation of chrome: URLs within PDF documents, creating a pathway for remote attackers to circumvent intended security restrictions. The vulnerability specifically affects Chrome versions prior to 47.0.2526.73, where PDFium fails to properly sanitize and validate URL schemes when processing PDF content. When a malicious PDF document contains a link to a chrome://settings URL, the renderer does not adequately restrict access to these privileged chrome scheme URLs, potentially allowing unauthorized access to sensitive browser settings and functionality. This represents a significant bypass of Chrome's security model, as chrome: URLs are designed to be accessible only within the browser's own context and should not be executable from external PDF content. The vulnerability aligns with CWE-20, "Improper Input Validation," and demonstrates how insufficient validation of URL schemes can lead to privilege escalation and unauthorized access to browser internals. From an operational perspective, this vulnerability enables attackers to craft malicious PDF documents that can redirect users to chrome://settings or similar privileged URLs, potentially exposing sensitive browser configurations or enabling further exploitation. The attack vector is particularly concerning because it leverages the trust users place in PDF documents, which are commonly opened from email attachments, web downloads, or other untrusted sources. According to ATT&CK framework, this vulnerability maps to T1059.007 "Command and Scripting Interpreter: JavaScript" and T1068 "Exploitation for Privilege Escalation" as it allows for the execution of privileged browser functions through crafted PDF content. The impact extends beyond simple information disclosure, as access to chrome://settings may provide attackers with insights into browser configurations, user preferences, and potentially sensitive data that could be used for further attacks. Organizations should immediately update to Chrome version 47.0.2526.73 or later, where proper URL scheme validation has been implemented to prevent unauthorized access to chrome: URLs. Additionally, implementing content filtering solutions and educating users about the risks of opening PDF documents from untrusted sources provides additional layers of defense. Security teams should also monitor for any indicators of compromise related to PDF-based attacks and ensure that all systems running affected versions of Chrome are patched promptly to prevent exploitation of this vulnerability. The remediation process involves not only updating the browser but also reviewing and potentially restricting PDF handling capabilities in enterprise environments where additional security controls may be necessary.