CVE-2016-1705
High · 8.8CVSS
8.8
EPSS
1.1%
Published
Jul 23, 2016
CISA due date
—
Cloudanix analysis
A flaw in an older version of the Chrome browser lets attackers crash it or potentially take over the computer if someone visits a harmful webpage without updating first.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Full Compromise
- Component
- Application
- Class
- Other
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Unspecified vulnerabilities in the browser engine allow remote attackers to cause denial of service or execute arbitrary code via crafted web content.
Why it matters to the business
Attackers can disrupt user browsing sessions or potentially compromise systems leading to data theft or further network access though specific risks remain unclear due to lack of details; the issue affects all unpatched Chrome deployments across an organization.
How an attack unfolds
An attacker crafts a malicious webpage that triggers the unknown vulnerability when visited by the victim using an affected browser version potentially leading to crashes or code execution.
How to fix it
Update Google Chrome to version 52.0.2743.82 or later as soon as possible.
How to confirm the fix worked
Verify Chrome version is 52.0.2743.82 or higher and confirm absence of related crash reports or anomalous behavior in browser processes.
Typical attack path
- Victim visits malicious site
- Vulnerability triggered in Chrome
- DoS or other impact achieved
How to detect it
Review browser crash logs web proxy logs and endpoint process activity for signs of unexpected terminations or visits to suspicious domains; no public exploitation details limit precise indicators.
What your security team should do
- Deploy browser updates to all endpoints immediately
- Enforce automatic updates where possible
- Monitor endpoint logs for unexpected browser terminations
The record
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:8 | chromium-browser | 0 | 52.0.2743.82-1~deb8u1 |
| Mageia:5 | chromium-browser-stable | 0 | 52.0.2743.82-1.mga5 |
| Red Hat:rhel_extras:6 | chromium-browser | 0 | 0:52.0.2743.82-1.el6 |
| Red Hat:rhel_extras:6 | chromium-browser-debuginfo | 0 | 0:52.0.2743.82-1.el6 |
| SUSE:Package Hub 12 | chromium | 0 | 52.0.2743.82-89.1 |
| Ubuntu:14.04:LTS | chromium-browser | 0 | 52.0.2743.116-0ubuntu0.14.04.1.1134 |
| Ubuntu:14.04:LTS | oxide-qt | 0 | 1.16.5-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 52.0.2743.116-0ubuntu0.16.04.1.1250 |
| Ubuntu:16.04:LTS | oxide-qt | 0 | 1.16.5-0ubuntu0.16.04.1 |
| openSUSE:Tumbleweed | chromium | 0 | 55.0.2883.75-3.1 |
| openSUSE:Tumbleweed | chromium | 0 | 113.0.5672.92-1.1 |
Related vulnerabilities
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects chromium-browser
- CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in… Also affects chromium-browser
- CVE-2017-5040 V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108… Also affects chromium-browser
- CVE-2017-5030 Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for… Also affects chromium-browser
- CVE-2017-5006 Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87… Also affects chromium-browser
- CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and… Also affects chromium-browser
- CVE-2016-5204 Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google… Also affects chromium-browser
- CVE-2016-5170 WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google… Also affects chromium-browser