CVE-2016-1652 — Cross-site Scripting in Google Chrome

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 38.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Google ChromeDebian LinuxOpensuse Leap+1 more
Timeline
PublishedApr 18
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDgoogle/chrome49.0.2623.112
▶NVDopensuse/leap42.1

Also affects: Debian Linux 8.0, Linux Enterprise 12.0

🔴Vulnerability Details

3
GHSA
GHSA-v5jp-qmf4-cp2r: Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system↗2022-05-14
▶
OSV
CVE-2016-1652: Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system↗2016-04-18
▶
CVEList
CVE-2016-1652: Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system↗2016-04-18
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: universal XSS in extension bindings↗2016-04-13
▶

💬Community

1
Bugzilla
CVE-2016-1652 chromium-browser: universal XSS in extension bindings↗2016-04-14
▶
CVE-2016-1652 — Cross-site Scripting in Google Chrome | cvebase