vulnwire
7.1high

CVE-2016-5173

The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote a…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known

The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.

Exploit prediction (EPSS)

1.02% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
Technology feeds
Google Chrome (RSS, critical only)

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.