Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Chrome allows malicious sites to bypass security checks

CVE-2016-1682 · published 10 years ago
Summary

A flaw in Google Chrome's handling of certain website registrations can let malicious sites evade security protections. This could put your browsing data at risk. Update your Chrome browser to the latest version to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google chrome <= 50.0.2661.102
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
canonical ubuntu_linux 14.04
15.10
16.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
opensuse leap 42.1
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
opensuse opensuse 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
suse linux_enterprise 12.0
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*
Original advisory text
The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remo...
The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a ServiceWorker registration.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-2547PK - Security Features
CWE-284Improper Access Control
Timeline
Published5 Jun 2016
Updated4 Nov 2026
First seen13 Mar 2026
Sources
CVE-2016-1682 · OSV
CVE-2016-1682 · NVD
Track software like this
Free during beta