CVE-2016-2845 in Google Chrome

要約 (英語)

The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation reports, related to FrameFetchContext.cpp and ResourceFetcher.cpp.

予約する

2016年03月04日

公開

2016年03月05日

エントリ

VulDB provides additional information and datapoints for this CVE:

識別子	脆弱性	CWE	悪用可	対策	CVE
81197	Google Chrome Content Security Policy ResourceFetcher.cpp 履歴 情報漏えい	200	未定義	公式な修正	CVE-2016-2845