CVE-2016-5128
HighSummary
In Google V8 before version 5.2.361.27 and in Google Chrome before version 52.0.2743.82, there is a vulnerability that allows API interceptors to modify a store target without setting a property. This enables remote attackers to bypass the Same Origin Policy via a crafted website.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to steal data or perform other malicious actions on websites that should not have access to data from other sources.
Recommendation
It is recommended to update Google V8 and Google Chrome to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Google V8, Google Chrome
See all- CVE-2016-5129High
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, allowing remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2016-1669High
The Zone::New function in Google V8 before version 5.0.71.47 and in Google Chrome before version 50.0.2661.102 does not properly determine when to expand certain memory allocations. This can lead to denial of service (buffer overflow) or other unspecified impacts via crafted JavaScript code.
- CVE-2016-1653High
The LoadBuffer implementation in Google V8, used in Google Chrome before version 50.0.2661.75, mishandles data types, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation.
- CVE-2016-1612High
The LoadIC::UpdateCaches function in Google V8, used in Google Chrome before version 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable. This allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.
- CVE-2015-3910High
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-3333High
Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1242High
The ReduceTransitionElementsKind function in Google V8 before version 4.2.77.8, as used in Google Chrome before version 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages 'type confusion' in the check-elimination optimization.
- CVE-2015-2238High
Multiple unspecified vulnerabilities in Google V8 before version 4.1.0.21, as used in Google Chrome before version 41.0.2272.76, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1346High
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2014-7967High
Multiple unspecified vulnerabilities in Google V8 before version 3.28.71.15, as used in Google Chrome before version 38.0.2125.101, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Original NVD description (English source)
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.