Insufficiently Sanitized DevTools URLs in Google Chrome
CVE-2016-5212

6.5MEDIUM

Key Information:

Vendor
Google
Status
Google Chrome Prior To 55.0.2883.75 For Mac, Windows And Linux, And 55.0.2883.84 For Android
Vendor
CVE Published:
19 January 2017

Summary

A vulnerability exists in Google Chrome versions prior to 55.0.2883.75 for Mac, Windows, and Linux, as well as 55.0.2883.84 for Android. This flaw occurs due to insufficient sanitization of DevTools URLs, which can be exploited by a remote attacker. By crafting a malicious HTML page, the attacker can potentially read local files from the victim's system. This vulnerability emphasizes the importance of robust input validation to safeguard user data and privacy.

Affected Version(s)

Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android

References

http://rhn.redhat.com/errata/RHSA-2016-2919.html
vendor-advisoryx_refsource_REDHAT
https://crbug.com/653134
x_refsource_CONFIRM
http://www.securityfocus.com/bid/94633
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.