Login Request a demo
Critical severity · published Aug 7, 2016
CVE-2016-5142
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers…
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
through 52.0.2743.82 · source: NVD
Affected product
CH
Chrome
Google
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5142
googlechromereleases.blogspot.com
http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-1580.html
www.debian.org
http://www.debian.org/security/2016/dsa-3645
www.securityfocus.com
http://www.securityfocus.com/bid/92276
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability