CVE-2016-1706
CriticalSummary
The PPAPI implementation in Google Chrome before version 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process. This allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type.
Risk Assessment
Attackers can exploit this vulnerability to carry out attacks that may lead to unauthorized access to the system or user data. This risk can result in serious security implications for the organization.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Additionally, monitoring and restricting access to plugins can enhance security.
Original NVD description (English source)
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc.