Google Chrome TreeScope::adoptIfNeeded function homology policy bypass vulnerability

Blink is the United States Google Google Inc. and Norway Opens Opera Software company jointly developed a set of browser layout engine rendering engine. A same-origin policy bypass vulnerability exists in the 'TreeScope::adoptIfNeeded' function in the WebKit/Source/core/dom/TreeScope.cpp file in...

CVE-2016-1667: Improper Access Control

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a...

CVE-2016-1668: Improper Access Control

The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

PT-2016-4895

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 50.0.2661.102 Opera affected versions not specified Description The issue is related to the TreeScope::adoptIfNeeded function in the DOM implementation in Blink, which does not prevent script execution during...

PT-2016-4896

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 50.0.2661.102 Opera affected versions not specified Description The issue allows remote attackers to bypass the Same Origin Policy via a crafted web site, due to the improper creation context used by the...

PT-2016-6040

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3.3 Safari versions prior to 9.1.2 tvOS versions prior to 9.2.2 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain image data from an unintended web site via a timing attack...

CVE-2016-1658

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...

CVE-2016-1658: Exposure of Sensitive Information to an Unauthorized Actor

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...

PT-2016-1732

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 50.0.2661.75 Opera versions prior to 50.0.2661.75 Description The issue arises from the incorrect reliance on GetOrigin method calls for origin comparisons in the Extensions subsystem. This allows remote attacke...

CVE-2016-0158

Microsoft Edge on Windows 10 is affected by CVE-2016-0158, an elevation of privilege vulnerability that bypasses the Same Origin Policy via cross‑domain policy enforcement weaknesses. Connected sources describe Edge failing to properly validate JavaScript and enforce domain restrictions, enabling...

CVE-2016-0158: Undefined Security Weakness

Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161...

CVE-2016-0161: Undefined Security Weakness

Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158...

Apple iOS/Safari Information Disclosure Vulnerability

Apple iOS is Apple's operating system for several smart devices.Apple Safari is an American Apple web browser that is the default browser that comes with the Mac OS X and iOS operating systems. The page load implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 fails to properly...

PT-2016-1522

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3 Safari versions prior to 9.1 Description The issue is related to the Page Loading implementation in WebKit, which mishandles HTTP responses with a 3xx status code. This allows remote attackers to spoof the...

PT-2016-1523

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3 Safari versions prior to 9.1 Description The issue is related to the Page Loading implementation in WebKit, which mishandles character encoding during access to cached data. This allows remote attackers to bypas...

CVE-2016-1786: Exposure of Sensitive Information to an Unauthorized Actor

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx aka redirection status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted...

CVE-2016-1785: Exposure of Sensitive Information to an Unauthorized Actor

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site...

CVE-2016-1779: Exposure of Sensitive Information to an Unauthorized Actor

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request...

PT-2016-1529

Name of the Vulnerable Software and Affected Versions Safari versions prior to 9.1 iOS versions prior to 9.3 Description The issue allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request. This is due to a lack of protection for...

CVE-2016-1967: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls aft...