CVE-2016-5201: Infoleak
A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
Other sources
An info leak flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=660678
External References:
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop9.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
Google Chrome for Linuxto a version that resolves this vulnerability.Fixed in 54.0.2840.100 - Upgrade
Upgrade
Google Chrome for Windowsto a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
Google Chrome for Macto a version that resolves this vulnerability.Fixed in 54.0.2840.98
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5201?
CVE-2016-5201 is considered a medium severity vulnerability due to its ability to expose privileged JavaScript code to remote attackers.
How do I fix CVE-2016-5201?
To fix CVE-2016-5201, update Google Chrome to version 54.0.2840.100 or later for Linux, 54.0.2840.99 or later for Windows, or 54.0.2840.98 or later for Mac.
What causes the vulnerability CVE-2016-5201?
CVE-2016-5201 is caused by a leak of privateClass in the extensions API, allowing unauthorized access to sensitive JavaScript code.
Who is affected by CVE-2016-5201?
Users of Google Chrome versions prior to 54.0.2840.100 on Linux, 54.0.2840.99 on Windows, and 54.0.2840.98 on Mac are affected by CVE-2016-5201.
What types of attacks can CVE-2016-5201 enable?
CVE-2016-5201 can enable remote attackers to execute malicious JavaScript code within the context of a victim's browser.