CVE-2015-1288
The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-17
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- google:chrome
- opensuse:opensuse
- redhat:enterprise_linux_desktop_supplementary
- redhat:enterprise_linux_server_supplementary
- redhat:enterprise_linux_server_supplementary_eus
- redhat:enterprise_linux_workstation_supplementary