CVE-2016-5144 — Improper Access Control in Google Chrome
Severity
9.8CRITICALNVD
OSV7.5
EPSS
1.4%
top 19.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 7
Latest updateMay 17
Description
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages1 packages
🔴Vulnerability Details
5GHSA▶
GHSA-9mg3-5jw3-fgp2: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52↗2022-05-17
GHSA▶
GHSA-w2gg-cp64-r9xq: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52↗2022-05-17
OSV▶
CVE-2016-5143: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52↗2016-08-07
OSV▶
CVE-2016-5144: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52↗2016-08-07