CVE-2016-5162
First published: Sun Sep 11 2016(Updated: )
The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks, and trick users into changing extension settings, via a crafted web site, a different vulnerability than CVE-2016-5160.
Credit: cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE Linux | =42.1 | |
| Google Chrome (Trace Event) | <=52.0.2743.116 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.html
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html
- http://rhn.redhat.com/errata/RHSA-2016-1854.html
- http://www.debian.org/security/2016/dsa-3660
- http://www.securityfocus.com/bid/92717
- http://www.securitytracker.com/id/1036729
- https://codereview.chromium.org/2007133004
- https://crbug.com/589237
- https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
- https://security.gentoo.org/glsa/201610-09
Frequently Asked Questions
What is the severity of CVE-2016-5162?
CVE-2016-5162 is rated as a high severity vulnerability due to potential unauthorized access to restricted resources.
How do I fix CVE-2016-5162?
To fix CVE-2016-5162, upgrade Google Chrome to version 53.0.2785.89 or later on Windows and OS X, or to version 53.0.2785.92 or later on Linux.
What software versions are affected by CVE-2016-5162?
CVE-2016-5162 affects Google Chrome versions prior to 53.0.2785.89 on Windows and OS X, and prior to 53.0.2785.92 on Linux, as well as openSUSE Leap 42.1.
What type of attack can exploit CVE-2016-5162?
CVE-2016-5162 can be exploited through cross-origin resource loading, potentially leading to data theft or unauthorized content access.
Where can I find more information about CVE-2016-5162?
More detailed information about CVE-2016-5162 can be found in security announcements related to this vulnerability.
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/opensuse
- canonical/suse linux
- version/suse linux/42.1
- vendor/google
- canonical/google chrome (trace event)
- version/google chrome (trace event)/52.0.2743.116