CVE-2016-1708
HighSummary
The inline-installation implementation in the Chrome Web Store in the Extensions subsystem in Google Chrome before version 52.0.2743.82 does not properly consider object lifetimes during progress observation, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.
Risk Assessment
Attackers may exploit this vulnerability to disrupt browser functionality, potentially leading to service unavailability for users.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity.
Other vulnerabilities in Google Chrome Extensions subsystem
See all- CVE-2016-5136High
Use-after-free vulnerability in user_script_injector.cc in the Extensions subsystem in Google Chrome before version 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
- CVE-2016-1632High
The Extensions subsystem in Google Chrome before version 49.0.2623.75 does not properly maintain its own properties, allowing remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast.
- CVE-2015-6788High
The ObjectBackedNativeHandler class in the extensions subsystem of Google Chrome before version 47.0.2526.80 improperly implements handler functions, which may lead to denial of service or other unspecified impacts.
Original NVD description (English source)
The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.