CVE-2016-1623

The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp.
Severity
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Atk. Vector
NETWORK
Atk. Complexity
LOW
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
debiandebian_linux
8.0
googlechrome
𝑥
≤ 48.0.2564.103
opensuseopensuse
13.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
wily
Fixed 48.0.2564.116-0ubuntu0.15.10.1.1221
released
vivid
ignored
trusty
Fixed 48.0.2564.116-0ubuntu0.14.04.1.1111
released
precise
ignored
oxide-qt
wily
Fixed 1.12.6-0ubuntu0.15.10.1
released
vivid
ignored
trusty
Fixed 1.12.6-0ubuntu0.14.04.1
released
precise
dne
Common Weakness Enumeration