{"api_version":"1","generated_at":"2026-07-23T03:11:37+00:00","cve":"CVE-2016-5173","urls":{"html":"https://cve.report/CVE-2016-5173","api":"https://cve.report/api/cve/CVE-2016-5173.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5173","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5173"},"summary":{"title":"CVE-2016-5173","description":"The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.","state":"PUBLISHED","assigner":"Chrome","published_at":"2016-09-25 20:59:05","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-284","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.1","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://security.gentoo.org/glsa/201610-09","name":"https://security.gentoo.org/glsa/201610-09","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chromium: Multiple vulnerabilities (GLSA 201610-09) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html","name":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chrome Releases: Stable Channel Update for Desktop","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://crbug.com/471523","name":"https://crbug.com/471523","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"471523 - \n \n \n chromium -\n \n \n An open-source project to help move the web forward. - \n \n Monorail","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1036826","name":"http://www.securitytracker.com/id/1036826","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Multiple Flaws Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://crbug.com/497507","name":"https://crbug.com/497507","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"497507 - \n Security: Cross-origin scripting possible via native functions - \n \n chromium -\n \n \n Monorail","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2016/dsa-3667","name":"http://www.debian.org/security/2016/dsa-3667","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3667-1 chromium-browser","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://codereview.chromium.org/1840453002","name":"https://codereview.chromium.org/1840453002","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 1840453002: [Extensions] More bindings hardening -\n    \n    Code Review","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/92942","name":"http://www.securityfocus.com/bid/92942","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Prior to 53.0.2785.113 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://crbug.com/468931","name":"https://crbug.com/468931","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"468931 - \n Security: Webpages have access to some extension resources - \n \n chromium -\n \n \n Monorail","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1905.html","name":"http://rhn.redhat.com/errata/RHSA-2016-1905.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5173","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5173","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5173","vulnerable":"1","versionEndIncluding":"53.0.2785.101","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"chrome","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2016","cve_id":"5173","cve":"CVE-2016-5173","epss":"0.007490000","percentile":"0.732230000","score_date":"2026-05-07","updated_at":"2026-05-08 00:14:43"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T00:53:48.201Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"DSA-3667","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2016/dsa-3667"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://codereview.chromium.org/1840453002"},{"name":"1036826","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1036826"},{"name":"92942","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/92942"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://crbug.com/468931"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://crbug.com/497507"},{"name":"GLSA-201610-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201610-09"},{"name":"RHSA-2016:1905","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2016-1905.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://crbug.com/471523"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-09-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-01-04T19:57:01.000Z","orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome"},"references":[{"name":"DSA-3667","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2016/dsa-3667"},{"tags":["x_refsource_CONFIRM"],"url":"https://codereview.chromium.org/1840453002"},{"name":"1036826","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1036826"},{"name":"92942","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/92942"},{"tags":["x_refsource_CONFIRM"],"url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://crbug.com/468931"},{"tags":["x_refsource_MISC"],"url":"https://crbug.com/497507"},{"name":"GLSA-201610-09","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201610-09"},{"name":"RHSA-2016:1905","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2016-1905.html"},{"tags":["x_refsource_MISC"],"url":"https://crbug.com/471523"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2016-5173","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"DSA-3667","refsource":"DEBIAN","url":"http://www.debian.org/security/2016/dsa-3667"},{"name":"https://codereview.chromium.org/1840453002","refsource":"CONFIRM","url":"https://codereview.chromium.org/1840453002"},{"name":"1036826","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1036826"},{"name":"92942","refsource":"BID","url":"http://www.securityfocus.com/bid/92942"},{"name":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html","refsource":"CONFIRM","url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html"},{"name":"https://crbug.com/468931","refsource":"CONFIRM","url":"https://crbug.com/468931"},{"name":"https://crbug.com/497507","refsource":"MISC","url":"https://crbug.com/497507"},{"name":"GLSA-201610-09","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201610-09"},{"name":"RHSA-2016:1905","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-1905.html"},{"name":"https://crbug.com/471523","refsource":"MISC","url":"https://crbug.com/471523"}]}}}},"cveMetadata":{"assignerOrgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","assignerShortName":"Chrome","cveId":"CVE-2016-5173","datePublished":"2016-09-25T20:00:00.000Z","dateReserved":"2016-05-31T00:00:00.000Z","dateUpdated":"2024-08-06T00:53:48.201Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-09-25 20:59:05","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-284","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndIncluding":"53.0.2785.101","matchCriteriaId":"AC271026-1CD7-42F7-8754-1C5144AD590B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5173","Ordinal":"1","Title":"CVE-2016-5173","CVE":"CVE-2016-5173","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5173","Ordinal":"1","NoteData":"The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.","Type":"Description","Title":"CVE-2016-5173"},{"CveYear":"2016","CveId":"5173","Ordinal":"2","NoteData":"2016-09-25","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5173","Ordinal":"3","NoteData":"2018-01-04","Type":"Other","Title":"Modified"}]}}}