CVE-2016-1632
HighSummary
The Extensions subsystem in Google Chrome before version 49.0.2623.75 does not properly maintain its own properties, allowing remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to data or functions within the browser, potentially leading to serious security breaches.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to regularly monitor and update all used extensions.
Other vulnerabilities in Google Chrome Extensions subsystem
See all- CVE-2016-5136High
Use-after-free vulnerability in user_script_injector.cc in the Extensions subsystem in Google Chrome before version 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
- CVE-2016-1708High
The inline-installation implementation in the Chrome Web Store in the Extensions subsystem in Google Chrome before version 52.0.2743.82 does not properly consider object lifetimes during progress observation, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.
- CVE-2015-6788High
The ObjectBackedNativeHandler class in the extensions subsystem of Google Chrome before version 47.0.2526.80 improperly implements handler functions, which may lead to denial of service or other unspecified impacts.
Original NVD description (English source)
The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.