Cross-site scripting in Yandex Browser for desktop
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.
Why it matters now
EPSS 0.0085 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Yandex | Yandex Browser for desktop | 15.12 to 16.2 for OSx and Linux | — | No fix listed | CNA |
- Yandex Browser for desktop VendorYandex Affected 15.12 to 16.2 for OSx and Linux Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yandex:yandex_browser:15.2.2214.3645:*:*:*:*:*:*:* | 15.2.2214.3645 | Vulnerable | Yandex |
| cpe:2.3:a:yandex:yandex_browser:15.4.2272.3429:*:*:*:*:*:*:* | 15.4.2272.3429 | Vulnerable | Yandex |
| cpe:2.3:a:yandex:yandex_browser:15.6.2311.5029:*:*:*:*:*:*:* | 15.6.2311.5029 | Vulnerable | Yandex |
| cpe:2.3:a:yandex:yandex_browser:15.12.0.6151:*:*:*:*:*:*:* | 15.12.0.6151 | Vulnerable | Yandex |
| cpe:2.3:a:yandex:yandex_browser:15.12.1.6475:*:*:*:*:*:*:* | 15.12.1.6475 | Vulnerable | Yandex |
| cpe:2.3:a:yandex:yandex_browser:16.2.0.3539:*:*:*:*:*:*:* | 16.2.0.3539 | Vulnerable | Yandex |
- cpe:2.3:a:yandex:yandex_browser:15.2.2214.3645:*:*:*:*:*:*:* Versions 15.2.2214.3645 Vulnerable ·Yandex
- cpe:2.3:a:yandex:yandex_browser:15.4.2272.3429:*:*:*:*:*:*:* Versions 15.4.2272.3429 Vulnerable ·Yandex
- cpe:2.3:a:yandex:yandex_browser:15.6.2311.5029:*:*:*:*:*:*:* Versions 15.6.2311.5029 Vulnerable ·Yandex
- cpe:2.3:a:yandex:yandex_browser:15.12.0.6151:*:*:*:*:*:*:* Versions 15.12.0.6151 Vulnerable ·Yandex
- cpe:2.3:a:yandex:yandex_browser:15.12.1.6475:*:*:*:*:*:*:* Versions 15.12.1.6475 Vulnerable ·Yandex
- cpe:2.3:a:yandex:yandex_browser:16.2.0.3539:*:*:*:*:*:*:* Versions 16.2.0.3539 Vulnerable ·Yandex
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8506
- 2026-10-03 Alias added: GHSA-4887-46jh-42cg
References
More Yandex Browser vulnerabilities
- TI-2024-06006 DLL Hijacking in Yandex Browser CVSS 4.0HIGH 8.4
- TI-2021-07512 Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. CVSS 4.0HIGH 8.3
- TI-2017-04997 Untrusted search path in Yandex Browser for Desktop CVSS 3.0HIGH 7.8
- TI-2021-07511 Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. CVSS 4.0HIGH 8.2
- TI-2023-11403 A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 CVSS 4.0HIGH 7.4
- TI-2022-11011 Link following in Yandex Browser CVSS 3.1HIGH 7.8
Sources
- CVE-2016-8506 · CVE Program
- CVE-2016-8506 · NVD
- FIRST EPSS
- GHSA-4887-46jh-42cg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences