CVE-2016-5132

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME...

CVE-2016-1710

The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1711

WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-5128

objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

PT-2016-6047

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3.3 Safari versions prior to 9.1.2 Description The issue is related to how WebKit in Apple iOS and Safari handles about: URLs, allowing remote attackers to bypass the Same Origin Policy via a crafted web site...

UBUNTU-CVE-2016-4590

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

CVE-2016-4583

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document...

CVE-2016-4590

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

UBUNTU-CVE-2016-4583

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document...

PT-2016-6252

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Google V8 versions prior to 5.2.361.27 Opera affected versions not specified Description The issue allows remote attackers to bypass the Same Origin Policy via a crafted web site, due to the failure...

PT-2016-6256

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue is related to the Service Workers subsystem not properly implementing the Secure Contexts specification. This allows remote attackers to...

PT-2016-2654

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue is related to the WebKit/Source/core/loader/FrameLoader.cpp file in the Blink component, which does not properly disable frame navigation...

PT-2016-2655

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.82 Opera affected versions not specified Description The issue concerns the ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink. This method does not prevent window...

Stable Channel Update

The Chrome team is delighted to announce the promotion of Chrome 52 to the stable channel for Windows, Mac and Linux. Chrome 52.0.2743.82 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 48 security fixes in this release, including: 610600 High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent's Xuanwu Lab 613949 High CVE-2016-1708: Use-after-free in Extensions. Credit to Adam Varsan 614934 High CVE-2016-1709:...

Paragon Initiative Enterprises: Content-type sniffing leads to stored XSS in CMS Airship on Internet Explorer

Description Internet Explorer has the nasty habit to perform Content-Type sniffing on delivered resources if the content-type is not known to it. Since the software isn't instructing Internet Explorer to disable content-type sniffing this leads to a stored XSS. In a nutshell, it is possible to...

WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)

Binary data 9387.prm...

Firefox RCE

The vulnerability of the Firefox browser allows a malicious actor to bypass access control policies SOP and execute arbitrary JavaScript code with privileges equivalent to those of Chrome, by using frame relays...

Firefox ESR Authentication Bypass

The Mozilla Firefox ESR browser contains a vulnerability related to errors in the implementation of the Web Workers technology. Exploiting this vulnerability allows malicious actors operating remotely to circumvent Domain Restrictions Policy SOP rules and gain access to authentication data throug...

Mozilla SeaMonkey Authentication Bypass

Mozilla SeaMonkey software contains a vulnerability related to errors in the implementation of the Web Workers technology. Exploiting this vulnerability allows malicious actors operating remotely to circumvent Domain Restrictions Policy SOP rules and gain access to authentication data through err...