CVE-2016-5173

The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.

CVSS v3.0 7.1 HIGH
CVSS v2.0 6.8 MEDIUM

7.1^/10

CVSS v3.0 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Exploitability : 2.8 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://codereview.chromium.org/1840453002	Issue Tracking Patch
https://crbug.com/497507	Issue Tracking Patch
https://crbug.com/468931	Issue Tracking Patch
https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html	Vendor Advisory
https://crbug.com/471523	Issue Tracking Patch
http://www.securityfocus.com/bid/92942
http://www.debian.org/security/2016/dsa-3667
https://security.gentoo.org/glsa/201610-09
http://www.securitytracker.com/id/1036826
http://rhn.redhat.com/errata/RHSA-2016-1905.html

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Information

Published : 2016-09-25 13:59

Updated : 2018-01-04 18:30

NVD link : CVE-2016-5173

Mitre link : CVE-2016-5173

JSON object : View

CWE

CWE-284

Improper Access Control

Advertisement

Products Affected

google

chrome

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://codereview.chromium.org/1840453002", "name": "https://codereview.chromium.org/1840453002", "tags": ["Issue Tracking", "Patch"], "refsource": "CONFIRM"}, {"url": "https://crbug.com/497507", "name": "https://crbug.com/497507", "tags": ["Issue Tracking", "Patch"], "refsource": "MISC"}, {"url": "https://crbug.com/468931", "name": "https://crbug.com/468931", "tags": ["Issue Tracking", "Patch"], "refsource": "CONFIRM"}, {"url": "https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html", "name": "https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://crbug.com/471523", "name": "https://crbug.com/471523", "tags": ["Issue Tracking", "Patch"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/92942", "name": "92942", "tags": [], "refsource": "BID"}, {"url": "http://www.debian.org/security/2016/dsa-3667", "name": "DSA-3667", "tags": [], "refsource": "DEBIAN"}, {"url": "https://security.gentoo.org/glsa/201610-09", "name": "GLSA-201610-09", "tags": [], "refsource": "GENTOO"}, {"url": "http://www.securitytracker.com/id/1036826", "name": "1036826", "tags": [], "refsource": "SECTRACK"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-1905.html", "name": "RHSA-2016:1905", "tags": [], "refsource": "REDHAT"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-284"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-5173", "ASSIGNER": "security@google.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.8}}, "publishedDate": "2016-09-25T20:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "53.0.2785.101"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-01-05T02:30Z"}