The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade chromium-browser | Sep 15, 2016 | Sep 15, 2016 |
| Freebsd | — | Upgrade chromiumUpgrade chromium-npapiUpgrade chromium-pulse | Nov 14, 2016 | Sep 16, 2016 |
| Gentoo Linux | — | Upgrade www-client/chromium. | Oct 30, 2017 | Sep 25, 2016 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 28, 2016 | Sep 13, 2016 |
| Redhat_linux | — | Upgrade chromium-browser-debuginfoUpgrade chromium-browser | Oct 21, 2016 | Sep 16, 2016 |
| Suse | — | Upgrade chromium-ffmpegsumoUpgrade chromium-desktop-kdeUpgrade chromedriverUpgrade chromiumUpgrade chromium-desktop-gnome | Sep 15, 2016 | Sep 15, 2016 |
| Ubuntu | — | Upgrade chromium-browser | Nov 19, 2024 | Sep 25, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub