content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Chrome | * | 43.0.2357.81 (including) | |
| Supplementary for Red Hat Enterprise Linux 6 | RedHat | chromium-browser-0:43.0.2357.130-1.el6_6 | * |
| Chromium-browser | Ubuntu | devel | * |
| Chromium-browser | Ubuntu | precise | * |
| Chromium-browser | Ubuntu | trusty | * |
| Chromium-browser | Ubuntu | upstream | * |
| Chromium-browser | Ubuntu | utopic | * |
| Chromium-browser | Ubuntu | vivid | * |
| Chromium-browser | Ubuntu | wily | * |
| Oxide-qt | Ubuntu | devel | * |
| Oxide-qt | Ubuntu | trusty | * |
| Oxide-qt | Ubuntu | upstream | * |
| Oxide-qt | Ubuntu | utopic | * |
| Oxide-qt | Ubuntu | vivid | * |
| Oxide-qt | Ubuntu | wily | * |