Security bypass in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-3353

Vulnerability identifier: #VU5246

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3353

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper handling of .URL files from the Internet zone. A remot attacker can create a specially crafted .URL file, trick the victim into opening it and bypass security features in the victim's browser.

Successful exploitation of the vulnerability results in security bypass on the target system.

Microsoft Edge
Microsoft Internet Explorer

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms16-104

• Multiple vulnerabilities in Microsoft Internet Explorer and Edge
• Internet Explorer Security Feature Bypass