CVE-2016-5164
published 2016-09-11CVE-2016-5164: Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on…
PriorityP425medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.04%
60.6th percentile
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 52.0.2743.116 | — | |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qx89-jffp-qh72: Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger
ghsa_unreviewed·2022-05-14
CVE-2016-5164 [MEDIUM] CWE-79 GHSA-qx89-jffp-qh72: Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."
OSV
oxide-qt vulnerabilities
osv·2016-09-14·CVSS 7.5
CVE-2016-5141 [HIGH] oxide-qt vulnerabilities
oxide-qt vulnerabilities
An issue was discovered in Blink involving the provisional URL for an
initially empty document. An attacker could potentially exploit this to
spoof the currently displayed URL. (CVE-2016-5141)
A use-after-free was discovered in the WebCrypto implementation in Blink.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code. (CVE-2016-5142)
It was discovered that the devtools subsystem in Blink mishandles various
parameters. An attacker could exploit this to bypass intended access
restrictions. (CVE-2016-5143, CVE-2016-5144)
It was discovered that Blink does not ensure that a taint property is
preserved after a structure-clone operatio
OSV
CVE-2016-5164: Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger
osv·2016-09-02·CVSS 6.1
CVE-2016-5164 [MEDIUM] CVE-2016-5164: Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2016-09-14·CVSS 7.5
CVE-2016-5141 [HIGH] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
An issue was discovered in Blink involving the provisional URL for an
initially empty document. An attacker could potentially exploit this to
spoof the currently displayed URL. (CVE-2016-5141)
A use-after-free was discovered in the WebCrypto implementation in Blink.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code. (CVE-2016-5142)
It was discovered that the devtools subsystem in Blink mishandles various
parameters. An attacker could exploit this to bypass intended access
restrictions. (CVE-2016-5143, CVE-2016-5144)
It was discovered that Blink does not ensure that a t
Red Hat
chromium-browser: universal xss using devtools
vendor_redhat·2016-08-31·CVSS 6.1
CVE-2016-5164 [MEDIUM] chromium-browser: universal xss using devtools
chromium-browser: universal xss using devtools
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."
No detection rules found.
No public exploits indexed.
Bugzilla
chromium: various flaws [fedora-all]
bugzilla·2016-09-01·CVSS 6.1
[MEDIUM] chromium: various flaws [fedora-all]
chromium: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has b
Bugzilla
CVE-2016-5164 chromium-browser: universal xss using devtools
bugzilla·2016-09-01·CVSS 6.1
CVE-2016-5164 [MEDIUM] CVE-2016-5164 chromium-browser: universal xss using devtools
CVE-2016-5164 chromium-browser: universal xss using devtools
The following flaw was identified in the Chromium browser: universal xss using devtools.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=637594
External References:
https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
Discussion:
Created chromium tracking bugs for this issue:
Affects: fedora-all [bug 1372232]
---
chromium-53.0.2785.101-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2016:1854 https://rhn.redhat.com/errata/RHSA-2016-1854.html
---
chromium-53.0.2785.10
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00073.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1854.htmlhttp://www.debian.org/security/2016/dsa-3660http://www.securityfocus.com/bid/92717http://www.securitytracker.com/id/1036729https://codereview.chromium.org/2253643002https://crbug.com/637594https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.htmlhttps://security.gentoo.org/glsa/201610-09http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00073.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1854.htmlhttp://www.debian.org/security/2016/dsa-3660http://www.securityfocus.com/bid/92717http://www.securitytracker.com/id/1036729https://codereview.chromium.org/2253643002https://crbug.com/637594https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.htmlhttps://security.gentoo.org/glsa/201610-09
2016-09-11
Published