PT-2016-3422 · Yandex · Yandex Browser

Published 2016-10-26 · Updated 2016-12-02 · CVE-2016-8502

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yandex Browser versions 15.12.0 through 16.2

Description The issue is related to the Anti-phishing function in Yandex Browser, which could be exploited by a remote attacker to brute-force passwords from important web resources using special JavaScript. This is due to errors in security settings, allowing a remote attacker to bypass existing security restrictions.

Recommendations For Yandex Browser versions 15.12.0 through 16.2, consider disabling the Anti-phishing function as a temporary workaround until a patch is available. Restrict access to sensitive web resources to minimize the risk of exploitation. Avoid using the browser for critical operations that involve sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2022-03565

CVE-2016-8502

Affected Products

Yandex Browser

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-8502 · Security Note
• https://bdu.fstec.ru/vul/2022-03565 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8502 · Vendor Advisory
• https://browser.yandex.com/security/changelogs · Vendor Advisory
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Note
• http://securityfocus.com/bid/93923 · Note