CVE-2016-1692: Medium severity ubuntu vulnerability
A limited cross-origin bypass flaw was found in the ServiceWorker component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=598077
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
Other sources
WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1692?
CVE-2016-1692 has a high severity rating as it allows for cross-origin loading of CSS stylesheets, which can lead to security vulnerabilities.
How do I fix CVE-2016-1692?
To mitigate CVE-2016-1692, users should update Google Chrome to version 51.0.2704.63 or later.
Which versions of Google Chrome are affected by CVE-2016-1692?
CVE-2016-1692 affects Google Chrome versions prior to 51.0.2704.63.
What type of vulnerability is CVE-2016-1692?
CVE-2016-1692 is a security vulnerability that compromises the Same Origin Policy through improper handling of stylesheet MIME types.
Are any other platforms affected by CVE-2016-1692?
Yes, CVE-2016-1692 also affects certain versions of Ubuntu, Debian, Red Hat, and openSUSE.