CVE-2016-5187 - Vulnerability Details - OpenCVE

Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00385.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:54.0.2840.59-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2016:2067	2016-10-17T00:00:00Z

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2016-2067.html
http://www.securityfocus.com/bid/93528
https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html
https://crbug.com/639702
https://googlechromereleases.blogspot.com/2016/10/stable-channel-update-for-desktop.html
https://nvd.nist.gov/vuln/detail/CVE-2016-5187
https://security.gentoo.org/glsa/201610-09
https://www.cve.org/CVERecord?id=CVE-2016-5187

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2016-12-18T03:34:00

Updated: 2024-08-06T00:53:48.641Z

Reserved: 2016-05-31T00:00:00

Link: CVE-2016-5187

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-12-18T03:59:00.337

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-5187

Redhat

Severity : Important

Publid Date: 2016-10-12T00:00:00Z

Links: CVE-2016-5187 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Chrome prior to 54.0.2840.85 for Android", "vendor": "n/a", "versions": [{"status": "affected", "version": "Chrome prior to 54.0.2840.85 for Android"}]}], "datePublic": "2016-12-17T00:00:00", "descriptions": [{"lang": "en", "value": "Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages."}], "problemTypes": [{"descriptions": [{"description": "spoof the contents of the Omnibox (URL bar)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/639702"}, {"name": "93528", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/93528"}, {"name": "RHSA-2016:2067", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2067.html"}, {"name": "GLSA-201610-09", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201610-09"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2016-5187", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Chrome prior to 54.0.2840.85 for Android", "version": {"version_data": [{"version_value": "Chrome prior to 54.0.2840.85 for Android"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "spoof the contents of the Omnibox (URL bar)"}]}]}, "references": {"reference_data": [{"name": "https://crbug.com/639702", "refsource": "CONFIRM", "url": "https://crbug.com/639702"}, {"name": "93528", "refsource": "BID", "url": "http://www.securityfocus.com/bid/93528"}, {"name": "RHSA-2016:2067", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2067.html"}, {"name": "GLSA-201610-09", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201610-09"}, {"name": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:53:48.641Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/639702"}, {"name": "93528", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/93528"}, {"name": "RHSA-2016:2067", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2067.html"}, {"name": "GLSA-201610-09", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201610-09"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2016-5187", "datePublished": "2016-12-18T03:34:00", "dateReserved": "2016-05-31T00:00:00", "dateUpdated": "2024-08-06T00:53:48.641Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "41415E17-B2B6-4695-BEE3-585170ECDCE4", "versionEndIncluding": "53.0.2785.143", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages."}, {"lang": "es", "value": "Google Chrome en versiones previas a 54.0.2840.85 para Android maneja incorrectamente transici\u00f3n r\u00e1pida de entrada y salida del modo de pantalla completa, lo que permite a un atacante remoto suplantar los contenidos de la Omnibox (barra de URL) a trav\u00e9s de p\u00e1ginas HTML manipuladas."}], "id": "CVE-2016-5187", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-12-18T03:59:00.337", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2016-2067.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/93528"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/639702"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201610-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2067.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/93528"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/639702"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201610-09"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}