CVE-2016-1623

The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp.
Configurations

Configuration 1 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

History

21 Nov 2024, 02:46

Type Values Removed Values Added
References () http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html - () http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html -
References () http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html - () http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html -
References () http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html - () http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html -
References () http://rhn.redhat.com/errata/RHSA-2016-0241.html - () http://rhn.redhat.com/errata/RHSA-2016-0241.html -
References () http://www.debian.org/security/2016/dsa-3486 - () http://www.debian.org/security/2016/dsa-3486 -
References () http://www.securityfocus.com/bid/83125 - () http://www.securityfocus.com/bid/83125 -
References () http://www.securitytracker.com/id/1035183 - () http://www.securitytracker.com/id/1035183 -
References () http://www.ubuntu.com/usn/USN-2895-1 - () http://www.ubuntu.com/usn/USN-2895-1 -
References () https://code.google.com/p/chromium/issues/detail?id=577105 - () https://code.google.com/p/chromium/issues/detail?id=577105 -
References () https://codereview.chromium.org/1659013003 - () https://codereview.chromium.org/1659013003 -
References () https://security.gentoo.org/glsa/201603-09 - () https://security.gentoo.org/glsa/201603-09 -

07 Nov 2023, 02:30

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/201603-09 - () https://security.gentoo.org/glsa/201603-09 -
References (SECTRACK) http://www.securitytracker.com/id/1035183 - () http://www.securitytracker.com/id/1035183 -
References (SUSE) http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html - () http://lists.opensuse.org/opensuse-updates/2016-02/msg00104.html -
References (CONFIRM) https://codereview.chromium.org/1659013003 - Patch () https://codereview.chromium.org/1659013003 -
References (CONFIRM) https://code.google.com/p/chromium/issues/detail?id=577105 - Exploit, Patch () https://code.google.com/p/chromium/issues/detail?id=577105 -
References (DEBIAN) http://www.debian.org/security/2016/dsa-3486 - Third Party Advisory () http://www.debian.org/security/2016/dsa-3486 -
References (UBUNTU) http://www.ubuntu.com/usn/USN-2895-1 - () http://www.ubuntu.com/usn/USN-2895-1 -
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-0241.html - () http://rhn.redhat.com/errata/RHSA-2016-0241.html -
References (SUSE) http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html - Third Party Advisory () http://lists.opensuse.org/opensuse-updates/2016-02/msg00119.html -
References (CONFIRM) http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html - Patch, Vendor Advisory () http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html -
References (BID) http://www.securityfocus.com/bid/83125 - () http://www.securityfocus.com/bid/83125 -

Information

Published : 2016-02-14 02:59

Updated : 2024-11-21 02:46


NVD link : CVE-2016-1623

Mitre link : CVE-2016-1623

CVE.ORG link : CVE-2016-1623


JSON object : View

Products Affected

debian

  • debian_linux

google

  • chrome

opensuse

  • opensuse
CWE
CWE-264

Permissions, Privileges, and Access Controls