CVE-2016-1697: High severity google chrome vulnerability
A cross-origin bypass flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=613266
External References:
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
Other sources
The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during DocumentLoader detach operations, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1697?
CVE-2016-1697 is classified as a high severity vulnerability due to its potential for bypassing the Same Origin Policy.
How do I fix CVE-2016-1697?
To fix CVE-2016-1697, you need to upgrade to Google Chrome version 51.0.2704.79 or later.
What systems are affected by CVE-2016-1697?
CVE-2016-1697 affects Google Chrome versions prior to 51.0.2704.79 and specific Linux distributions such as Ubuntu, Debian, and openSUSE using older versions.
What types of attacks can exploit CVE-2016-1697?
CVE-2016-1697 can be exploited by remote attackers through crafted JavaScript to manipulate frame navigations.
Is CVE-2016-1697 still a concern for modern browsers?
CVE-2016-1697 is not a concern for modern browsers as browsers have since updated to versions that address this vulnerability.