How severe is CVE-2016-8508?

CVE-2016-8508 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2016-8508 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-8508?

CVE-2016-8508 affects Yandex Yandex Browser. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2016-8508?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2016-8508 published?

CVE-2016-8508 was published on 2017-03-01 and last updated on 2026-06-17.

CVE-2016-8508

CVE-2016-8508 is a medium-severity vulnerability in Yandex Yandex Browser with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-254.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.3
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-254
Affected product: Yandex Yandex Browser
Published: 2017-03-01
Last modified: 2026-06-17

Description

Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.

Frequently asked questions

What is CVE-2016-8508?: Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site.
How severe is CVE-2016-8508?: CVE-2016-8508 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2016-8508 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-8508?: CVE-2016-8508 affects Yandex Yandex Browser. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-8508?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2016-8508 published?: CVE-2016-8508 was published on 2017-03-01 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:yandex:yandex_browser:*:*:*:*:*:*:*:*

More vulnerabilities in Yandex Yandex Browser

CVE-2023-26226 — Critical (CVSS 9.8): A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
CVE-2024-6473 — High (CVSS 7.8): Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVE-2022-28226 — High (CVSS 7.8): Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged,…
CVE-2022-28225 — High (CVSS 7.8): Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged,…
CVE-2021-25261 — High (CVSS 7.8): Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged,…
CVE-2021-25263 — High (CVSS 7.8): Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged,…

All CVEs affecting Yandex Yandex Browser →

Other CWE-254 vulnerabilities

CVE-2016-5788 — Critical (CVSS 10.0): General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open…
CVE-2015-3972 — Critical (CVSS 10.0): The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication,…
CVE-2015-1158 — Critical (CVSS 10.0): The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for…
CVE-2019-15149 — Critical (CVSS 9.8): core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a…
CVE-2017-8227 — Critical (CVSS 9.8): Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect…
CVE-2016-9568 — Critical (CVSS 9.8): A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform…

Browse all CWE-254 vulnerabilities →