CVE-2016-5132 in Chrome

Résumé

par MITRE

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Réserver: 31/05/2016
• Divulgation: 23/07/2016
• Modérer: accepté
• Entrée: VDB-90240
• CPE: prêt
• CWE: CWE-254 (confirmé)
• CVSS: 8.8 (NVD)
• EPSS: 0.01465
• KEV: non
• Activités: très faible
• Secteur: Finance, Lawfirm, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-5132
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-5132
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-5132/