CVE-2016-1664: Medium severity Google Chrome vulnerability
An address bar spoofing flaw flaw was identified in the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=597322
External References:
http://googlechromereleases.blogspot.com/2016/04/stable-channel-update28.html
Other sources
The HistoryController::UpdateForCommit function in content/renderer/historycontroller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar via a crafted web site.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 50.0.2661.94 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 50.0.2661.94
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1664?
The severity of CVE-2016-1664 is classified as high due to the potential for remote spoofing attacks.
How do I fix CVE-2016-1664?
To fix CVE-2016-1664, update Google Chrome to version 50.0.2661.94 or later.
Which versions of Google Chrome are affected by CVE-2016-1664?
CVE-2016-1664 affects Google Chrome versions prior to 50.0.2661.94.
What type of attack does CVE-2016-1664 enable?
CVE-2016-1664 enables remote attackers to spoof the address bar through crafted websites.
Which platforms are impacted by CVE-2016-1664?
CVE-2016-1664 impacts multiple platforms including Google Chrome and certain versions of Red Hat and openSUSE.