CVE-2016-1658

Description

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.

References

https://security.gentoo.org/glsa/201605-02

https://crbug.com/573317

https://codereview.chromium.org/1658913002

http://www.debian.org/security/2016/dsa-3549

http://rhn.redhat.com/errata/RHSA-2016-0638.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00049.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00041.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00040.html

http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_13.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3