Privilege Escalation in Microsoft Edge and Microsoft Internet Explorer - CVE-2016-3387

Vulnerability identifier: #VU928

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3387

CWE-ID: CWE-46

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to improper defense of private namespace by the browser. A remote attacker can create a specially crafted content, trick the victim into downloading it, gain privileged permissions to the namespace directory on the system.

Successful exploitation of the vulnerability will result in privilege escalation on the vulnerable system.

Microsoft Edge
Microsoft Internet Explorer

Install update from vendor's website.

• Exploit #424 - Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118) (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms16-118
• https://technet.microsoft.com/en-us/library/security/ms16-119

• Multiple vulnerabilities in Microsoft Internet Explorer
• Multiple vulnerabilities in Microsoft Edge
• Microsoft Browser Elevation of Privilege Vulnerability