CVE-2016-1708

The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified...

CVE-2016-5136

Use-after-free vulnerability in extensions/renderer/userscriptinjector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion...

PT-2016-2709

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue is related to a use-after-free vulnerability in the Extensions subsystem, specifically in the extensions/renderer/user script injector.cc...

PT-2016-2657

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Description The issue is related to the implementation of the Chrome Web Store inline-installation in the Extensions subsystem, which does not properly consider object lifetimes during progress...

CVE-2016-1696

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

Design/Logic Flaw

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2016-1696

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2016-1696

Removed by vendor...

CVE-2016-1696: Improper Access Control

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2016-1674: Undefined Security Weakness

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

CVE-2016-1696

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors...

PT-2016-2164

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 51.0.2704.63 Opera affected versions not specified Description The issue is related to errors in the code of the extensions subsystem, allowing a remote attacker to bypass the existing access restriction policy,...

KLA10816 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, obtain sensitive information or conduct another unknown impact. Below is a complete list of vulnerabilities: 1. Multiple...

Google Chrome Information Disclosure

The vulnerability in the Google Chrome browser’s Extensions subsystem exists due to the improper use of the GetOrigin method. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or obtain confidential information...

CVE-2016-1652

Cross-site scripting XSS vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/modulesystem.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS...

CVE-2016-1658

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...

CVE-2016-1652

Cross-site scripting XSS vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/modulesystem.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS...

CVE-2016-1658

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...

CVE-2016-1652

Removed by vendor...

CVE-2016-1658: Exposure of Sensitive Information to an Unauthorized Actor

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...