CVE-2016-1697 The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during DocumentLoader detach...
HighCVSS 8.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during DocumentLoader detach operations, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | <= 51.0.2704.63 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| SUSE linux enterprise | = 12.0 | No fix listed |
References
- googlechromereleases.blogspot.com
- openSUSE-SU-2016:1489 vendor-advisory
- SUSE-SU-2016:1490 vendor-advisory
- openSUSE-SU-2016:1496 vendor-advisory
- DSA-3594 vendor-advisory
- 1036026 vdb-entry
- USN-2992-1 vendor-advisory
- RHSA-2016:1201 vendor-advisory
- codereview.chromium.org
- crbug.com