Man-in-the-Middle Vulnerability in Google Chrome's Software Removal Tool

CVE-2016-1693

Summary

In Google Chrome prior to version 51.0.2704.63, a vulnerability exists in the handling of the Software Removal Tool (CCT). The application fails to enforce HTTPS connections when obtaining the tool from dl.google.com, which allows attackers to exploit this oversight. By using a man-in-the-middle attack on an unencrypted HTTP session, remote attackers can successfully spoof the CCT executable. This can lead to unauthorized execution of malicious software under the guise of legitimate tool functionality, posing significant security risks to users.

References