CVE-2016-1697
Fixed in a distro release EPSS 2%
The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during DocumentLoader detach operations, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Products: google chrome, canonical ubuntu_linux, debian_linux, opensuse leap, opensuse, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation, suse linux_enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | chromium-browser | 51.0.2704.79-1~deb8u1 |
| Red Hat rhel extras 6 | chromium-browser | 0:51.0.2704.79-1.el6 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:51.0.2704.79-1.el6 |
| Ubuntu 14.04 LTS | chromium-browser | 51.0.2704.79-0ubuntu0.14.04.1.1121 |
| Ubuntu 14.04 LTS | oxide-qt | 1.15.7-0ubuntu0.14.04.1 |
| Ubuntu 16.04 LTS | chromium-browser | 51.0.2704.79-0ubuntu0.16.04.1.1242 |
| Ubuntu 16.04 LTS | oxide-qt | 1.15.7-0ubuntu0.16.04.1 |
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |