CVE-2016-7282

Vulnerability

CVE-2016-7282 is a cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge. The flaw exists due to improper handling of objects in memory, allowing arbitrary web script or HTML injection through unspecified vectors. The vulnerability is addressed in MS16-144 [1] for Internet Explorer and MS16-145 [2] for Microsoft Edge.

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted webpage that, when viewed by a user in an affected browser, triggers the XSS condition. No further user interaction beyond visiting the page is required. The attacker does not need any special network position beyond being able to serve content to the victim.

Impact

Successful exploitation leads to information disclosure, as the injected script can access browser data and potentially leak sensitive information. The attacker gains the ability to execute arbitrary web script or HTML in the context of the victim's browser session, but the vulnerability does not result in remote code execution or system compromise on its own.

Mitigation

Microsoft released security updates in December 2016 as part of MS16-144 [1] and MS16-145 [2], which correct the underlying handling issues. Users should apply the cumulative updates KB3204059 (Internet Explorer) and KB3204062 (Microsoft Edge) to protect affected systems.