{"id":"CVE-2016-5167","aliases":["DSA-3660-1","EUVD-2016-6118","GHSA-xj65-c785-82wr","MGASA-2016-0309","RHSA-2016:1854","UBUNTU-CVE-2016-5167","USN-3058-1"],"status":"published","title":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and...","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01352,"percentile":0.71727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2016-09-02T00:00:00Z","modified":"2026-06-29T10:13:42Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"chromium-browser","fixed_in":["53.0.2785.143-0ubuntu0.14.04.1.1142"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","fixed_in":["1.17.7-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"chromium-browser","fixed_in":["53.0.2785.143-0ubuntu0.16.04.1.1254"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","fixed_in":["1.17.7-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.2785.89-1~deb8u1"}]}],"versions":["41.0.2272.118-1","42.0.2311.135-1","42.0.2311.135-1~deb8u1","42.0.2311.135-2","42.0.2311.90-1","42.0.2311.90-1~deb8u1","42.0.2311.90-2","43.0.2357.124-1","43.0.2357.124-2","43.0.2357.124-3","43.0.2357.130-1","43.0.2357.65-1","43.0.2357.65-1~deb8u1","43.0.2357.81-1","44.0.2403.107-1","44.0.2403.107-2","44.0.2403.157-1","44.0.2403.89-1","44.0.2403.89-1~deb8u1","45.0.2454.101-1","45.0.2454.85-1","45.0.2454.85-1~deb8u1","46.0.2490.13-1","46.0.2490.71-1","46.0.2490.71-1~deb8u1","47.0.2526.111-1","47.0.2526.16-1","47.0.2526.73-1","47.0.2526.73-1~deb8u1","47.0.2526.80-1","47.0.2526.80-1~deb8u1","47.0.2526.80-2","47.0.2526.80-3","48.0.2564.116-1","48.0.2564.116-1~deb8u1","48.0.2564.23-1","48.0.2564.82-1","48.0.2564.82-1~deb8u1","48.0.2564.82-2","49.0.2623.108-1","49.0.2623.108-1~deb8u1","49.0.2623.108-2","49.0.2623.75-1","49.0.2623.75-1~deb8u1","49.0.2623.75-2","49.0.2623.87-1","49.0.2623.87-1~deb8u1","50.0.2661.75-1","50.0.2661.75-1~deb8u1","50.0.2661.75-2","50.0.2661.94-1","50.0.2661.94-1~deb8u1","51.0.2704.63-1","51.0.2704.63-1~deb8u1","51.0.2704.63-2","51.0.2704.79-1","51.0.2704.79-1~deb8u1","52.0.2743.116-1","52.0.2743.116-1~deb8u1","52.0.2743.116-2","52.0.2743.82-1","52.0.2743.82-1~deb8u1","52.0.2743.82-2","52.0.2743.82-3","52.0.2743.82-4"],"bundled":21},{"source":"osv","ecosystem":"Mageia:5","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.2785.113-1.mga5"}]}],"bundled":27},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:53.0.2785.89-3.el6"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:53.0.2785.89-3.el6"}]}],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.2785.143-0ubuntu0.14.04.1.1142"}]}],"versions":["29.0.1547.65-0ubuntu2","31.0.1650.63-0ubuntu1~20131204.1","32.0.1700.107-0ubuntu1~20140204.977.1","33.0.1750.152-0ubuntu1~pkg995.1","34.0.1847.116-0ubuntu2","36.0.1985.125-0ubuntu1.14.04.0~pkg1029","37.0.2062.94-0ubuntu0.14.04.1~pkg1042","37.0.2062.120-0ubuntu0.14.04.1~pkg1049","38.0.2125.111-0ubuntu0.14.04.1.1061","39.0.2171.65-0ubuntu0.14.04.1.1064","40.0.2214.94-0ubuntu0.14.04.1.1068","40.0.2214.111-0ubuntu0.14.04.1.1069","41.0.2272.76-0ubuntu0.14.04.1.1076","43.0.2357.81-0ubuntu0.14.04.1.1089","43.0.2357.130-0ubuntu0.14.04.1.1092","44.0.2403.89-0ubuntu0.14.04.1.1095","45.0.2454.85-0ubuntu0.14.04.1.1097","45.0.2454.101-0ubuntu0.14.04.1.1099","47.0.2526.73-0ubuntu0.14.04.1.1106","47.0.2526.106-0ubuntu0.14.04.1.1107","48.0.2564.82-0ubuntu0.14.04.1.1108","48.0.2564.116-0ubuntu0.14.04.1.1111","49.0.2623.87-0ubuntu0.14.04.1.1112","49.0.2623.108-0ubuntu0.14.04.1.1113","50.0.2661.102-0ubuntu0.14.04.1.1117","51.0.2704.79-0ubuntu0.14.04.1.1121","52.0.2743.116-0ubuntu0.14.04.1.1134"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-0ubuntu0.14.04.1"}]}],"versions":["1.0.0~bzr437-0ubuntu1","1.0.0~bzr452-0ubuntu1","1.0.0~bzr475-0ubuntu1","1.0.0~bzr490-0ubuntu1","1.0.0~bzr501-0ubuntu1","1.0.0~bzr501-0ubuntu2","1.0.4-0ubuntu0.14.04.1","1.0.5-0ubuntu0.14.04.1","1.1.2-0ubuntu0.14.04.1","1.2.5-0ubuntu0.14.04.1","1.3.4-0ubuntu0.14.04.1","1.4.2-0ubuntu0.14.04.1","1.4.3-0ubuntu0.14.04.1","1.5.5-0ubuntu0.14.04.3","1.5.6-0ubuntu0.14.04.2","1.6.5-0ubuntu0.14.04.1","1.6.6-0ubuntu0.14.04.1","1.7.8-0ubuntu0.14.04.1","1.7.9-0ubuntu0.14.04.1","1.8.4-0ubuntu0.14.04.2","1.9.1-0ubuntu0.14.04.2","1.9.5-0ubuntu0.14.04.1","1.10.3-0ubuntu0.14.04.1","1.11.3-0ubuntu0.14.04.1","1.11.4-0ubuntu0.14.04.1","1.12.5-0ubuntu0.14.04.1","1.12.6-0ubuntu0.14.04.1","1.12.7-0ubuntu0.14.04.1","1.13.6-0ubuntu0.14.04.1","1.14.7-0ubuntu0.14.04.1","1.14.9-0ubuntu0.14.04.1","1.15.7-0ubuntu0.14.04.1","1.15.8-0ubuntu0.14.04.1","1.16.5-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"53.0.2785.143-0ubuntu0.16.04.1.1254"}]}],"versions":["45.0.2454.101-0ubuntu1.1201","47.0.2526.73-0ubuntu1.1218","47.0.2526.106-0ubuntu1.1221","48.0.2564.82-0ubuntu1.1222","48.0.2564.116-0ubuntu1.1229","49.0.2623.87-0ubuntu1.1232","49.0.2623.108-0ubuntu1.1233","50.0.2661.102-0ubuntu0.16.04.1.1237","51.0.2704.79-0ubuntu0.16.04.1.1242","52.0.2743.116-0ubuntu0.16.04.1.1250"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-0ubuntu0.16.04.1"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-0ubuntu0.14.04.1"}]}],"versions":["1.0.0~bzr437-0ubuntu1","1.0.0~bzr452-0ubuntu1","1.0.0~bzr475-0ubuntu1","1.0.0~bzr490-0ubuntu1","1.0.0~bzr501-0ubuntu1","1.0.0~bzr501-0ubuntu2","1.0.4-0ubuntu0.14.04.1","1.0.5-0ubuntu0.14.04.1","1.1.2-0ubuntu0.14.04.1","1.2.5-0ubuntu0.14.04.1","1.3.4-0ubuntu0.14.04.1","1.4.2-0ubuntu0.14.04.1","1.4.3-0ubuntu0.14.04.1","1.5.5-0ubuntu0.14.04.3","1.5.6-0ubuntu0.14.04.2","1.6.5-0ubuntu0.14.04.1","1.6.6-0ubuntu0.14.04.1","1.7.8-0ubuntu0.14.04.1","1.7.9-0ubuntu0.14.04.1","1.8.4-0ubuntu0.14.04.2","1.9.1-0ubuntu0.14.04.2","1.9.5-0ubuntu0.14.04.1","1.10.3-0ubuntu0.14.04.1","1.11.3-0ubuntu0.14.04.1","1.11.4-0ubuntu0.14.04.1","1.12.5-0ubuntu0.14.04.1","1.12.6-0ubuntu0.14.04.1","1.12.7-0ubuntu0.14.04.1","1.13.6-0ubuntu0.14.04.1","1.14.7-0ubuntu0.14.04.1","1.14.9-0ubuntu0.14.04.1","1.15.7-0ubuntu0.14.04.1","1.15.8-0ubuntu0.14.04.1","1.16.5-0ubuntu0.14.04.1"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-0ubuntu0.16.04.1"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1"],"bundled":16}],"products":[{"vendor":"google","product":"chrome"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://crbug.com/633585","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/627355","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/617648","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/634394","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html","tags":["x_refsource_CONFIRM","x_transferred","web","article"]},{"url":"https://crbug.com/624213","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/92717","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1036729","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://crbug.com/625575","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/619379","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/627418","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://crbug.com/624214","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://crbug.com/642598","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3660","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201610-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://crbug.com/637320","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1854.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://crbug.com/634557","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5167","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xj65-c785-82wr"},{"url":"https://advisories.mageia.org/MGASA-2016-0309.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19281","tags":["report"]},{"url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1854","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1372229","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1854.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5148","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5149","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5150","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5152","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5153","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5154","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5156","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5157","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5157","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5158","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5162","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5163","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5164","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5165","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5165","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5166","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5167","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2016-5167","tags":["report"]},{"url":"http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3058-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5165","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5167","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","status":"published","published":"2016-09-11T10:00:00Z","modified":"2024-08-06T00:53:48.206Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6118","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","status":"published","published":"2016-09-11T10:00:00Z","modified":"2024-08-06T00:53:48Z","updated_at":"2026-11-03T02:22:43.529102Z"}],"ghsa":[{"id":"GHSA-xj65-c785-82wr","title":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and...","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","status":"published","published":"2022-05-14T02:12:20Z","modified":"2023-02-02T05:05:21Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:52:06.092141Z"}],"nvd":[{"id":"CVE-2016-5167","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","status":"published","published":"2016-09-11T10:59:24.303Z","modified":"2026-06-17T00:48:53.553Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"RHSA-2016:1854","title":"Red Hat Security Advisory: chromium-browser security update","status":"published","published":"2024-09-13T11:05:39Z","modified":"2026-06-29T10:13:42Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-5167","description":"Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.","status":"published","published":"2016-09-02T00:00:00Z","modified":"2026-04-22T10:49:41.969681Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DSA-3660-1","title":"chromium-browser - security update","status":"published","published":"2016-09-05T00:00:00Z","modified":"2026-03-09T01:23:21.666171Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0309","title":"Updated chromium-browser-stable packages fix security vulnerability","description":"Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and\nbefore 53.0.2785.92 on Linux, mishandles deferred page loads, which\nallows remote attackers to inject arbitrary web script or HTML via a\ncrafted web site, aka \"Universal XSS (UXSS).\" (CVE-2016-5147)\n\nCross-site scripting (XSS) vulnerability in Blink, as used in Chromium\nbefore 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on\nLinux, allows remote attackers to inject arbitrary web script or HTML\nvia vectors related to widget updates, aka \"Universal XSS (UXSS).\"\n(CVE-2016-5148)\n\nThe extensions subsystem in Chromium before 53.0.2785.89 on Windows and\nOS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to\nidentify an associated extension, which allows remote attackers to\nconduct extension-bindings injection attacks by leveraging script access\nto a resource that initially has the about:blank URL. (CVE-2016-5149)\n\nWebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as\nused in Chromium before 53.0.2785.89 on Windows and OS X and before\n53.0.2785.92 on Linux, has an Indexed Database (aka IndexedDB) API\nimplementation that does not properly restrict key-path evaluation,\nwhich allows remote attackers to cause a denial of service\n(use-after-free) or possibly have unspecified other impact via crafted\nJavaScript code that leverages certain side effects. (CVE-2016-5150)\n\nPDFium in Chromium before 53.0.2785.89 on Windows and OS X and before\n53.0.2785.92 on Linux mishandles timers, which allows remote attackers\nto cause a denial of service (use-after-free) or possibly have\nunspecified other impact via a crafted PDF document, related to\nfpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp.\n(CVE-2016-5151)\n\nInteger overflow in the opj_tcd_get_decoded_tile_size function in tcd.c\nin OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on\nWindows and OS X and before 53.0.2785.92 on Linux, allows remote\nattackers to cause a denial of service (heap-based buffer overflow) or\npossibly have unspecified other impact via crafted JPEG 2000 data.\n(CVE-2016-5152)\n\nThe Web Animations implementation in Blink, as used in Chromium before\n53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux,\nimproperly relies on list iteration, which allows remote attackers to\ncause a denial of service (use-after-destruction) or possibly have\nunspecified other impact via a crafted web site. (CVE-2016-5153)\n\nMultiple heap-based buffer overflows in PDFium, as used in Chromium\nbefore 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on\nLinux, allow remote attackers to cause a denial of service or possibly\nhave unspecified other impact via a crafted JBig2 image. (CVE-2016-5154)\n\nChromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92\non Linux does not properly validate access to the initial document,\nwhich allows remote attackers to spoof the address bar via a crafted web\nsite. (CVE-2016-5155)\n\nextensions/renderer/event_bindings.cc in the event bindings in Chromium\nbefore 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux\nattempts to process filtered events after failure to add an event\nmatcher, which allows remote attackers to cause a denial of service\n(use-after-free) or possibly have unspecified other impact via unknown\nvectors. (CVE-2016-5156)\n\nHeap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c\nin OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on\nWindows and OS X and before 53.0.2785.92 on Linux, allows remote\nattackers to execute arbitrary code via crafted coordinate values in\nJPEG 2000 data. (CVE-2016-5157)\n\nMultiple integer overflows in the opj_tcd_init_tile function in tcd.c in\nOpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows\nand OS X and before 53.0.2785.92 on Linux, allow remote attackers to\ncause a denial of service (heap-based buffer overflow) or possibly have\nunspecified other impact via crafted JPEG 2000 data. (CVE-2016-5158)\n\nMultiple integer overflows in OpenJPEG, as used in PDFium in Chromium\nbefore 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on\nLinux, allow remote attackers to cause a denial of service (heap-based\nbuffer overflow) or possibly have unspecified other impact via crafted\nJPEG 2000 data that is mishandled during opj_aligned_malloc calls in\ndwt.c and t1.c. (CVE-2016-5159)\n\nThe AllowCrossRendererResourceLoad function in\nextensions/browser/url_request_util.cc in Chromium before 53.0.2785.89\non Windows and OS X and before 53.0.2785.92 on Linux does not properly\nuse an extension's manifest.json web_accessible_resources field for\nrestrictions on IFRAME elements, which makes it easier for remote\nattackers to conduct clickjacking attacks, and trick users into changing\nextension settings, via a crafted web site, a different vulnerability\nthan CVE-2016-5162. (CVE-2016-5160)\n\nThe EditingStyle::mergeStyle function in\nWebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in\nChromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92\non Linux, mishandles custom properties, which allows remote attackers to\ncause a denial of service or possibly have unspecified other impact via\na crafted web site that leverages \"type confusion\" in the\nStylePropertySerializer class. (CVE-2016-5161)\n\nThe AllowCrossRendererResourceLoad function in\nextensions/browser/url_request_util.cc in Chromium before 53.0.2785.89\non Windows and OS X and before 53.0.2785.92 on Linux does not properly\nuse an extension's manifest.json web_accessible_resources field for\nrestrictions on IFRAME elements, which makes it easier for remote\nattackers to conduct clickjacking attacks, and trick users into changing\nextension settings, via a crafted web site, a different vulnerability\nthan CVE-2016-5160. (CVE-2016-5162)\n\nThe bidirectional-text implementation in Chromium before 53.0.2785.89 on\nWindows and OS X and before 53.0.2785.92 on Linux does not ensure\nleft-to-right (LTR) rendering of URLs, which allows remote attackers to\nspoof the address bar via crafted right-to-left (RTL) Unicode text,\nrelated to omnibox/SuggestionView.java and omnibox/UrlBar.java in Chrome\nfor Android. (CVE-2016-5163)\n\nCross-site scripting (XSS) vulnerability in\nWebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in\nChromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92\non Linux, allows remote attackers to inject arbitrary web script or HTML\ninto the Developer Tools (aka DevTools) subsystem via a crafted web\nsite, aka \"Universal XSS (UXSS).\" (CVE-2016-5164)\n\nCross-site scripting (XSS) vulnerability in the Developer Tools (aka\nDevTools) subsystem in Chromium before 53.0.2785.89 on Windows and OS X\nand before 53.0.2785.92 on Linux allows remote attackers to inject\narbitrary web script or HTML via the settings parameter in a\nchrome-devtools-frontend.appspot.com URL's query string. (CVE-2016-5165)\n\nThe download implementation in Chromium before 53.0.2785.89 on Windows\nand OS X and before 53.0.2785.92 on Linux does not properly restrict\nsaving a file:// URL that is referenced by an http:// URL, which makes\nit easier for user-assisted remote attackers to discover NetNTLM hashes\nand conduct SMB relay attacks via a crafted web page that is accessed\nwith the \"Save page as\" menu choice. (CVE-2016-5166)\n\nMultiple unspecified vulnerabilities in Chromium before 53.0.2785.89 on\nWindows and OS X and before 53.0.2785.92 on Linux allow attackers to\ncause a denial of service or possibly have other impact via unknown\nvectors. (CVE-2016-5167)\n\nWebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as\nused in Chromium before 53.0.2785.113, has an Indexed Database (aka\nIndexedDB) API implementation that inspects properties not owned by the\narray when converting an array to a key, resulting in side effects and a\npotential use-after-free problem. (CVE-2016-5170)\n\nBlink, as used in Chromium before 53.0.2785.113, allowed its\nWindowProperties constructor to be called from javascript, resulting in\na potential use-after-free problem. (CVE-2016-5171)\n\nChromium before 53.0.2785.113 exhibits three more separate issues:\narbitrary Memory Read in v8 (CVE-2016-5172), extension resource access\n(CVE-2016-5173), and a pop-up event was not correctly suppressed\n(CVE-2016-5174).\n\nFinally, Chromium 53.0.2785.113 contains (as usual) various fixes from\nupstream's internal audits, fuzzing and other initiatives.\n(CVE-2016-5175)\n","status":"published","published":"2016-09-21T20:38:22Z","modified":"2026-04-16T06:23:16.864300156Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-3058-1","title":"oxide-qt vulnerabilities","description":"An issue was discovered in Blink involving the provisional URL for an\ninitially empty document. An attacker could potentially exploit this to\nspoof the currently displayed URL. (CVE-2016-5141)\n\nA use-after-free was discovered in the WebCrypto implementation in Blink.\nIf a user were tricked in to opening a specially crafted website, an\nattacker could potentially exploit this to cause a denial of service via\napplication crash, or execute arbitrary code. (CVE-2016-5142)\n\nIt was discovered that the devtools subsystem in Blink mishandles various\nparameters. An attacker could exploit this to bypass intended access\nrestrictions. (CVE-2016-5143, CVE-2016-5144)\n\nIt was discovered that Blink does not ensure that a taint property is\npreserved after a structure-clone operation on an ImageBitmap object\nderived from a cross-origin image. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit this to\nbypass same origin restrictions. (CVE-2016-5145)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash, or execute arbitrary code.\n(CVE-2016-5146, CVE-2016-5167)\n\nIt was discovered that Blink mishandles deferred page loads. If a user\nwere tricked in to opening a specially crafted website, an attacker could\npotentially exploit this to conduct cross-site scripting (XSS) attacks.\n(CVE-2016-5147)\n\nAn issue was discovered in Blink related to widget updates. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit this to conduct cross-site scripting (XSS) attacks.\n(CVE-2016-5148)\n\nA use-after-free was discovered in Blink. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via application crash, or execute\narbitrary code. (CVE-2016-5150)\n\nA use-after-free was discovered in Blink. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via application crash, or execute\narbitrary code. (CVE-2016-5153)\n\nIt was discovered that Chromium does not correctly validate access to the\ninitial document. An attacker could potentially exploit this to spoof the\ncurrently displayed URL. (CVE-2016-5155)\n\nA use-after-free was discovered in the event bindings in Blink. If a user\nwere tricked in to opening a specially crafted website, an attacker could\npotentially exploit this to cause a denial of service via application\ncrash, or execute arbitrary code. (CVE-2016-5156)\n\nA type confusion bug was discovered in Blink. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via application crash, or execute\narbitrary code. (CVE-2016-5161)\n\nAn issue was discovered with the devtools implementation. An attacker\ncould potentially exploit this to conduct cross-site scripting (XSS)\nattacks. (CVE-2016-5164)\n\nAn issue was discovered with the devtools implementation. An attacker\ncould potentially exploit this to conduct cross-site scripting (XSS)\nattacks. (CVE-2016-5165)\n","status":"published","published":"2016-09-14T22:16:53Z","modified":"2026-04-22T09:26:47.827752Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}