CVE-2016-1668

High

Published: 14/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The forEachForBinding function in V8 bindings in Blink, used in Google Chrome before version 50.0.2661.102, uses an improper creation context, allowing remote attackers to bypass the Same Origin Policy via a crafted website.

Risk Assessment

An attacker could exploit this vulnerability to conduct cross-site attacks, potentially leading to the theft of user data or other unauthorized actions.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.

Other vulnerabilities in Google Chrome (przed wersją 50.0.2661.102)

CVE-2016-1667High
The TreeScope::adoptIfNeeded function in the DOM implementation in Blink, used in Google Chrome before version 50.0.2661.102, does not prevent script execution during node-adoption operations. This allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Original NVD description (English source)

The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.