What is CVE-2016-5160?

CVE-2016-5160 is a medium-severity vulnerability in Google Chrome, classified under CWE-254. CVSS score: 6.5/10. Published 2016-09-11.

How severe is CVE-2016-5160?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2016-5160 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Google Chrome

CVE-2016-5160

The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks, and trick users into changing extension settings, via a crafted web site, a different vulnerability than CVE-2016-5162.

Published 2016-09-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.015 (72.8th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Google Chrome
openSUSE Leap — versions 42.1

Weakness classification (CWE)

CWE-254

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html (vendor-advisory)
googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31…
crbug.com/576867
lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.html (vendor-advisory)
www.securityfocus.com/bid/92717 (vdb-entry)
www.securitytracker.com/id/1036729 (vdb-entry)
lists.opensuse.org/opensuse-updates/2016-09/msg00073.html (vendor-advisory)
codereview.chromium.org/2007133004
www.debian.org/security/2016/dsa-3660 (vendor-advisory)
security.gentoo.org/glsa/201610-09 (vendor-advisory)

Frequently asked questions

What is CVE-2016-5160?: CVE-2016-5160 is a medium-severity vulnerability in Google Chrome, classified under CWE-254. CVSS score: 6.5/10. Published 2016-09-11.
How severe is CVE-2016-5160?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2016-5160 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.