cve.bz

CVE-2016-5132

8.8 highEPSS 1.5%

High (8.8) in google chrome. EPSS 1.5% chance of exploitation in the next 30 days.

The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE
CWE-254
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON