VulnerabilityModified
CVE-2016-5204
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a…
MEDIUM 6.1EPSS 1.15%
Does this matter?
Lower severity and a low EPSS score (1.15%). Track it; it rarely justifies an emergency change on its own.
Description
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.15% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- google/chrome
- Source
- chrome-cve-admin@google.com
References
- http://rhn.redhat.com/errata/RHSA-2016-2919.html
- http://www.securityfocus.com/bid/94633
- https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
- https://crbug.com/630870
- https://security.gentoo.org/glsa/201612-11
- http://rhn.redhat.com/errata/RHSA-2016-2919.html
- http://www.securityfocus.com/bid/94633
- https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
- https://crbug.com/630870
- https://security.gentoo.org/glsa/201612-11
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.