CVE-2016-1699

medium

Published 2016-06-05 · Modified 2026-05-06

CVSS v3

6.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2

4.3

VIR risk

6.5

Description

WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

OS impact

OS	Version	Status
ubuntu	14.04	affected
rhel	6.0	affected
ubuntu	15.10	affected
ubuntu	16.04	affected
debian	8.0	affected
suse	42.1	affected
suse	13.2	affected

Application impact

Vendor	Product	Versions	Fixed
google	chrome	`{"endIncluding":"51.0.2704.63"}`

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.