CVE-2016-5132

—

CVSS 3.0

8.8 high

EPSS

1%p72

Published

Jul 23, 2016 (Jul 23, 2016)

Modified

Jun 17, 2026

Description

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

Vendors: google
Products: chrome
Weakness: CWE-254
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.