PT-2016-3048 · Google+5 · Blink+7
Marius.Mlynski
·
Publicado
2016-12-01
·
Atualizado
2025-09-29
·
CVE-2016-5204
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 55.0.2883.75
Google Chrome for Android versions prior to 55.0.2883.84
Description
The issue exists due to the lack of protection for the web page structure in the Blink component of Google Chrome. This allows a remote attacker to obtain information about the integration platform and operating system using a specially crafted HTML page. The vulnerability is caused by the leaking of an SVG shadow tree, leading to corruption of the DOM tree, which enables a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page.
Recommendations
For Google Chrome versions prior to 55.0.2883.75, update to version 55.0.2883.75 or later.
For Google Chrome for Android versions prior to 55.0.2883.84, update to version 55.0.2883.84 or later.
As a temporary workaround, consider restricting access to crafted HTML pages to minimize the risk of exploitation.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Blink
Google Chrome
Google Chrome For Android
Opera
Red Hat
Suse
Ubuntu