CVE-2016-2845

The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of…

published March 6, 2016

CVSS
—
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation reports, related to FrameFetchContext.cpp and ResourceFetcher.cpp.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02124 · 81.8th percentile
Published
2016-03-06T02:00Z
EPSS history
Timeline
  • 06 MAR 02:00Z
    The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of…
    cvelistv5