The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade chromium-browser | Sep 15, 2016 | Sep 15, 2016 |
| Freebsd | — | Upgrade chromiumUpgrade chromium-npapiUpgrade chromium-pulse | Nov 14, 2016 | Sep 16, 2016 |
| Gentoo Linux | — | Upgrade www-client/chromium. | Oct 30, 2017 | Sep 25, 2016 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 28, 2016 | Sep 13, 2016 |
| Redhat_linux | — | Upgrade chromium-browserUpgrade chromium-browser-debuginfo | Oct 21, 2016 | Sep 16, 2016 |
| Suse | — | Upgrade chromedriverUpgrade chromium-ffmpegsumoUpgrade chromium-desktop-kdeUpgrade chromium-desktop-gnomeUpgrade chromium | Sep 15, 2016 | Sep 15, 2016 |
| Ubuntu | — | Upgrade chromium-browser | Nov 19, 2024 | Sep 25, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub