Is CVE-2016-5226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5226 being exploited in the wild.

How severe is CVE-2016-5226?

Medium severity, with a CVSS score of 6.1, published 19 January 2017.

Which products and versions are affected?

Google Chromium Prior to 55.0.2883.75.

Is there a fix for CVE-2016-5226?

A patch was published on 2016-12-05: Gentoo released updated Chromium packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5226 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-5226?

Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5226: Google Chrome XSS via drag and drop in Blink

CVE-2016-5226 · Severity: medium · CVSS 6.1 · Published 2017-01-19

A vulnerability in the Google Chrome web browser allowed malicious scripts to be executed if a user was tricked into dragging and dropping a specific link into their address bar. This could allow an attacker to perform actions on behalf of the user on the currently open website, potentially leading to the theft of session information or unauthorized data access. Users are protected by updating to the latest version of the browser.

Technologies: Google Chrome, Google Chromium. Vendors: Google.

Quick answers

Is CVE-2016-5226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5226 being exploited in the wild.
How severe is CVE-2016-5226?: Medium severity, with a CVSS score of 6.1, published 19 January 2017.
Which products and versions are affected?: Google Chromium Prior to 55.0.2883.75.
Is there a fix for CVE-2016-5226?: A patch was published on 2016-12-05: Gentoo released updated Chromium packages Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5226 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-5226?: Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Blink rendering engine of Google Chrome and Chromium where 'javascript:' URLs are executed in the context of the current tab when dragged and dropped into the address bar (Omnibox). This flaw allows for a limited Cross-Site Scripting (XSS) attack. While the attack requires significant user interaction (social engineering to perform the drag-and-drop action), it bypasses expected security boundaries by executing script in the origin of the active page. The issue was addressed in version 55.0.2883.75 by preventing the automatic execution of such URLs through this specific UI interaction.

Affected products

Google Chrome Prior to 55.0.2883.75
Google Chromium Prior to 55.0.2883.75

Timeline

2016-12-01: advisory: Google released Chrome 55.0.2883.75 to the stable channel
2016-12-05: patched: Gentoo released updated Chromium packages
2016-12-07: patched: Red Hat released updated chromium-browser packages
2017-01-19: disclosed: NVD published the CVE record

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.