CVE-2016-1676
published 2016-06-05CVE-2016-1676: extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote…
PriorityP340high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.53%
74.6th percentile
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| chrome | <= 50.0.2661.102 | — | |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x2rc-63p9-cxrv: extensions/renderer/resources/binding
ghsa_unreviewed·2022-05-14
CVE-2016-1676 [HIGH] CWE-284 GHSA-x2rc-63p9-cxrv: extensions/renderer/resources/binding
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
OSV
CVE-2016-1676: extensions/renderer/resources/binding
osv·2016-06-05·CVSS 8.8
CVE-2016-1676 [HIGH] CVE-2016-1676: extensions/renderer/resources/binding
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Red Hat
chromium-browser: cross-origin bypass in extension bindings
vendor_redhat·2016-05-25·CVSS 8.8
CVE-2016-1676 [HIGH] chromium-browser: cross-origin bypass in extension bindings
chromium-browser: cross-origin bypass in extension bindings
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3590http://www.securityfocus.com/bid/90876http://www.securitytracker.com/id/1035981https://access.redhat.com/errata/RHSA-2016:1190https://codereview.chromium.org/1903273003https://crbug.com/604901https://security.gentoo.org/glsa/201607-07http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3590http://www.securityfocus.com/bid/90876http://www.securitytracker.com/id/1035981https://access.redhat.com/errata/RHSA-2016:1190https://codereview.chromium.org/1903273003https://crbug.com/604901https://security.gentoo.org/glsa/201607-07
2016-06-05
Published