CVE-2018-16072 describes a missing origin check in Google Chrome's Blink rendering engine, specifically concerning HLS manifests, prior to version 69.0.3497.81. This flaw allowed a remote attacker to bypass the Same-Origin Policy (SOP) by enticing a user to visit a specially crafted HTML page. With a CVSS score of 6.5 (Medium), this vulnerability has a low attack complexity and requires user interaction, but could lead to high confidentiality impact. There is no evidence of active exploitation, nor are there publicly available exploit modules in common frameworks like Metasploit or Nuclei, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 69.0.3497.81CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.