CVE-2020-15262: Insufficient Verification of Data Authenticity

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

CVE-2016-1636

CVE-2016-1636 affects Google Chrome/Chromium prior to 49.0.2623.75, where PendingScript::notifyFinished incorrectly uses memory-cache data about integrity-check occurrences rather than actual integrity-check successes. This enables bypassing Subresource Integrity (SRI) by triggering two loads of ...