CVE-2016-1667

High

Published: 14/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The TreeScope::adoptIfNeeded function in the DOM implementation in Blink, used in Google Chrome before version 50.0.2661.102, does not prevent script execution during node-adoption operations. This allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Risk Assessment

Attackers can exploit this vulnerability to perform cross-site scripting (XSS) attacks, potentially leading to the theft of user data or session hijacking.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring user activity.

Other vulnerabilities in Google Chrome (przed wersją 50.0.2661.102)

CVE-2016-1668High
The forEachForBinding function in V8 bindings in Blink, used in Google Chrome before version 50.0.2661.102, uses an improper creation context, allowing remote attackers to bypass the Same Origin Policy via a crafted website.

Original NVD description (English source)

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.