Information Disclosure in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-7199

Detailed vulnerability description

A remote attacker can obtain potentially sensitive information.

The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and obtain browser window state from a different domain.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information.

Note: this vulnerability was publicly disclosed.

How to mitigate CVE-2016-7199

Windows 10 for 32-bit Systems:
https://support.microsoft.com/kb/3198585
Windows 10 for x64-based Systems:
https://support.microsoft.com/kb/3198585
Windows 10 Version 1511 for 32-bit Systems:
https://support.microsoft.com/kb/3198586
Windows 10 Version 1511 for x64-based Systems:
https://support.microsoft.com/kb/3198586
Windows 10 Version 1607 for 32-bit Systems:
https://support.microsoft.com/kb/3200970
Windows 10 Version 1607 for x64-based Systems:
https://support.microsoft.com/kb/3200970
Windows Server 2016 for x64-based Systems:
https://support.microsoft.com/kb/3200970

Sources

• https://technet.microsoft.com/library/security/MS16-129