Security bypass in Microsoft Edge - CVE-2016-3392

Vulnerability identifier: #VU933

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3392

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness is due to improper validation of crafted documents by the Edge Content Security Policy used by the affected software. A remote attacker can create a specially crafted Web site containing a malicious content, trick the victim into opening it and bypass security restrictions on the vulnerable system.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Microsoft Edge

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms16-119

• Multiple vulnerabilities in Microsoft Edge
• Microsoft Browser Security Feature Bypass Vulnerability