The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1630
Reference (s):
- BID:84008
- URL: http://www.securityfocus.com/bid/84008
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html
- https://code.google.com/p/chromium/issues/detail?id=560011
- https://codereview.chromium.org/1464223002