PT-2016-1258 · Google+3 · Google Chrome+3

Publicado

2016-02-09

·

Atualizado

2024-06-15

·

CVE-2016-1627

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 48.0.2564.109
Description The issue is related to the Developer Tools (aka DevTools) subsystem, which does not properly validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL. This allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools ui bindings.cc and WebKit/Source/devtools/front end/Runtime.js.
Recommendations For Google Chrome versions prior to 48.0.2564.109, update to version 48.0.2564.109 or later to resolve the issue. As a temporary workaround, consider restricting access to the remoteBase parameter in the Developer Tools subsystem until a patch is available.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-1098
BDU:2016-00530
CVE-2016-1627
DSA-3486-1
MGASA-2016-0127
OPENSUSE-SU-2024:10171-1
OPENSUSE-SU-2024:12948-1
RHSA-2016:0241
RHSA-2016_0241

Produtos afetados

Alt Linux
Google Chrome
Opera
Red Hat