UBUNTU-CVE-2016-1636

Advisory lineage Upstream: 1 Downstream: 1

Upstream

CVE-2016-1636

Downstream

USN-2920-1

Published: 05 Mar 2016, 00:00

Last modified:22 Apr 2026, 10:32

Vulnerability Summary

Overall Risk (default)

high

70/100

CVSS Score

9.8 CRITICAL

3.0 (osv_ubuntu)

EPSS Score

No data

KEV

Not listed

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

05 Mar 2016, 00:00

Published

Vulnerability first disclosed

22 Apr 2026, 10:32

Last Modified

Vulnerability information updated

Description

The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.

CVSS Metrics

v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Systems

ubuntu•chromium-browser
< 49.0.2623.87-0ubuntu0.14.04.1.1112
ubuntu•oxide-qt
< 1.13.6-0ubuntu0.14.04.1