Non notée

CVE-2016-5191 Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had…

Description

Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android	Versions non publiées

Références

codereview.chromium.org codereview.chromium.org
93528 www.securityfocus.com
crbug.com crbug.com
RHSA-2016:2067 rhn.redhat.com
GLSA-201610-09 security.gentoo.org
chromereleases.googleblog.com chromereleases.googleblog.com

Chronologie

Publiée 18 décembre 2016
Dernière modification 6 août 2024

Les 9 CVE de Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android →

CVE-2016-5186 Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly… Non notée CVE-2016-5189 Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob… Non notée CVE-2016-5181 Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution… Non notée CVE-2016-5190 Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object… Non notée

Suivre cette CVE