NVD

Id
20511  
Name
CVE-2016-5173  
Description
The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-09-25  
Modified Date
2017-01-06  
Seq
2016-5173  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
112374 20511 CVE-2016-5173 DSA-3667  View
112375 20511 CVE-2016-5173 92942  View
112376 20511 CVE-2016-5173 https://codereview.chromium.org/1840453002  View
112377 20511 CVE-2016-5173 https://crbug.com/468931  View
112378 20511 CVE-2016-5173 https://crbug.com/471523  View
112379 20511 CVE-2016-5173 https://crbug.com/497507  View
112380 20511 CVE-2016-5173 https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
4142 JVNDB-2016-004915 Google Chrome の拡張サブシステムにおける意図しないリソースをロードされる脆弱性 Google Chrome の拡張サブシステムは、Object.prototype へのアクセスを適切に制限しないため、意図しないリソースをロードされ、その結果、意図しない JavaScript 関数の呼び出しを誘発され、同一生成元ポリシーを回避される脆弱性が存在します。 CVE-2016-5173 91679 CVE-2016-5173 20511 6.8 7.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004915.html 2016-09-13 2016-09-28 View