CVE-2016-10604

Vulnerability

The npm package dalek-browser-chrome (versions <= 0.0.11) downloads Google Chrome binary resources via plain HTTP connections instead of HTTPS. This insecure transport exposes the binary to man-in-the-middle attacks during the download process because no TLS encryption or integrity verification is used for the fetched executable [1], [2].

Exploitation

An attacker with a privileged network position — such as being on the same local network, controlling a compromised router, or intercepting traffic at an ISP level — can intercept the HTTP download request and replace the legitimate binary with an attacker-controlled executable. No authentication or user interaction beyond the package’s normal installation is required; the package itself performs the unauthenticated HTTP download [2].

Impact

Successful exploitation leads to remote code execution (RCE) on the system where dalek-browser-chrome is installed. The attacker-supplied binary runs with the privileges of the user or process installing the package, giving the attacker full control over that execution context and the ability to compromise the entire host [1], [2].

Mitigation

No official patch is available for this vulnerability [2]. The recommended mitigation is to avoid using dalek-browser-chrome altogether; the package author suggests migrating to an alternative like TestCafé [2]. Users who must retain the package should only install or run it on private, trusted networks where the risk of MITM interception is minimized [2].