Not rated

CVE-2016-5191 Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had…

Description

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL.

Affected products and versions

Product	Affected versions	Fixed in
Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android	Versions not published

References

codereview.chromium.org codereview.chromium.org
93528 www.securityfocus.com
crbug.com crbug.com
RHSA-2016:2067 rhn.redhat.com
GLSA-201610-09 security.gentoo.org
chromereleases.googleblog.com chromereleases.googleblog.com

Timeline

Published December 18, 2016
Last modified August 6, 2024

The 9 CVEs of Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android →

CVE-2016-5186 Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly… Not rated CVE-2016-5189 Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob… Not rated CVE-2016-5181 Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution… Not rated CVE-2016-5190 Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object… Not rated

Track this CVE