CVE-2016-1636

🗓️ 06 Mar 2016 02:00:00Reported by ChromeType

PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, allowing bypass of Subresource Integrity protection mechanism by triggering two loads of the same resource

Reporter	Title	Published	Views	Family All 51
ArchLinux	chromium: multiple issues	3 Mar 201600:00	–	archlinux
CNVD	Google Chrome Security Bypass Vulnerability (CNVD-2016-01515)	8 Mar 201600:00	–	cnvd
CVE	CVE-2016-1636	6 Mar 201602:00	–	cve
Debian	[SECURITY] [DSA 3507-1] chromium-browser security update	5 Mar 201621:22	–	debian
Debian	[SECURITY] [DSA 3507-1] chromium-browser security update	5 Mar 201621:22	–	debian
Debian CVE	CVE-2016-1636	6 Mar 201602:00	–	debiancve
Tenable Nessus	Debian DSA-3507-1 : chromium-browser - security update	7 Mar 201600:00	–	nessus
Tenable Nessus	FreeBSD : chromium -- multiple vulnerabilities (f85fa236-e2a6-412e-b5c7-c42120892de5)	7 Mar 201600:00	–	nessus
Tenable Nessus	GLSA-201603-09 : Chromium: Multiple vulnerabilities	14 Mar 201600:00	–	nessus
Tenable Nessus	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities	4 Mar 201600:00	–	nessus

Source	Link
security	www.security.gentoo.org/glsa/201603-09
code	www.code.google.com/p/chromium/issues/detail
lists	www.lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html
codereview	www.codereview.chromium.org/1713093002
lists	www.lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html
securityfocus	www.securityfocus.com/bid/84008
googlechromereleases	www.googlechromereleases.blogspot.com/2016/03/stable-channel-update.html
ubuntu	www.ubuntu.com/usn/USN-2920-1
securitytracker	www.securitytracker.com/id/1035185
lists	www.lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html

01 Dec 2016 15:57Current

8.9High risk

Vulners AI Score8.9

EPSS0.01448