CVE-2016-8504

Published: Oct 26, 2016Modified: May 6, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.

Affected (1)

Products: Yandex: Yandex Browser

Yandex

1 product

Yandex Browser

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Yandex Yandex Browser	Up to 16.6.1.30165

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://www.securityfocus.com/bid/93924

Source: browser-security@yandex-team.ru

Third Party AdvisoryVDB Entry

https://browser.yandex.com/security/changelogs/

Source: browser-security@yandex-team.ru

Release NotesVendor Advisory

http://www.securityfocus.com/bid/93924

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://browser.yandex.com/security/changelogs/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.