XSS in Google Chrome
CVE-2016-5204
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.011 (63.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Google Chrome
- N/a Google Chrome Prior To 55.0.2883.75 For Mac, Windows And Linux, 55.0.2883.84 Android — versions Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chrome-cve-admin@google.com (x_refsource_REDHAT, vendor-advisory)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vdb-entry, x_refsource_BID)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2016-5204?
- CVE-2016-5204 is a medium-severity vulnerability in Google Chrome, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-01-19.
- How severe is CVE-2016-5204?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2016-5204 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.