CVE-2016-1706 — Improper Input Validation in Google Chrome

CWE-20 — Improper Input Validation8 documents6 sources
Severity
9.6CRITICALNVD
OSV8.8
EPSS
1.4%
top 19.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedJul 23
Latest updateMay 17

Description

The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages1 packages

▶NVDgoogle/chrome51.0.2704.106

🔴Vulnerability Details

3
GHSA
GHSA-4c3c-m7vg-64hg: The PPAPI implementation in Google Chrome before 52↗2022-05-17
▶
OSV
oxide-qt vulnerabilities↗2016-08-05
▶
OSV
CVE-2016-1706: The PPAPI implementation in Google Chrome before 52↗2016-07-23
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2016-08-05
▶
Red Hat
chromium-browser: sandbox escape in ppapi↗2016-07-20
▶

💬Community

2
Bugzilla
CVE-2016-1706 chromium-browser: sandbox escape in ppapi↗2016-07-21
▶
Bugzilla
python-pillow: Buffer overflow in PcdDecode.c↗2016-02-05
▶