CVE-2016-5144

Critical

Published: 07/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter. This allows remote attackers to bypass intended access restrictions via a crafted URL.

Risk Assessment

The organization may be exposed to attacks that allow unauthorized access to resources by exploiting this vulnerability. This could lead to the disclosure of sensitive information or system takeover.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Additionally, monitoring and restricting access to developer tools in production environments is advisable.

Original NVD description (English source)

The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.