Executive brief
A vulnerability in the Google Chrome web browser could allow a malicious website to bypass security boundaries and run unauthorized scripts. This occurs through a flaw in how the browser handles web page elements, potentially leading to the theft of sensitive information or unauthorized actions on other websites the user is visiting. Users are protected by updating to the latest version of the browser.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in the Blink rendering engine of Google Chrome due to improper handling of the Document Object Model (DOM) tree during synchronous event handling. By enticing a user to visit a specially crafted HTML page, a remote attacker can cause DOM tree corruption, enabling the injection of arbitrary scripts or HTML that bypasses the Same-Origin Policy (SOP). This allows the attacker to execute scripts in the context of any website currently open in the browser. The issue was addressed in Chrome version 55.0.2883.75 for desktop and 55.0.2883.84 for Android.
Affected products
- Google Chrome < 55.0.2883.75 (Linux, Windows), < 55.0.2883.84 (Android)
- Google Chromium < 55.0.2883.75
Timeline
- 2016-12-01: patched: Chrome Stable Channel Update for Desktop released
- 2016-12-05: advisory: Gentoo Linux security advisory published
- 2016-12-07: advisory: Red Hat security advisory published
- 2017-01-19: disclosed: NVD publication date