CVE-2016-5143

Critical

Published: 07/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Developer Tools (DevTools) subsystem in Blink, used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase, and remoteFrontendUrl parameters. This allows remote attackers to bypass intended access restrictions via a crafted URL.

Risk Assessment

The organization may be exposed to attacks that allow unauthorized access to resources by exploiting vulnerabilities in the browser. This could lead to the disclosure of sensitive information or system takeover.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Additionally, consider monitoring and restricting access to developer tools in production environments.

Original NVD description (English source)

The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144.