CVE-2016-5132: google chrome 7PK - Security Features

Vulnerability summary

CVE-2016-5132 is a high (CVSS 8.8) 7PK - Security Features vulnerability in google chrome. EPSS estimates a 1.47% chance of exploitation in the next 30 days, higher than 73.2% of scored vulnerabilities.

Timeline

1. 23-07-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

• CWE-2547PK - Security FeaturesSoftware security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.