CVE-2016-5160: Medium severity suse linux vulnerability
The AllowCrossRendererResourceLoad function in extensions/browser/urlrequestutil.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json webaccessibleresources field for restrictions on IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks, and trick users into changing extension settings, via a crafted web site, a different vulnerability than CVE-2016-5162.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5160?
CVE-2016-5160 is classified as a high severity vulnerability due to improper handling of web_accessible_resources in Google Chrome.
How do I fix CVE-2016-5160?
To mitigate CVE-2016-5160, users should update Google Chrome to version 53.0.2785.89 or later.
Which versions of Google Chrome are affected by CVE-2016-5160?
CVE-2016-5160 affects Google Chrome versions prior to 53.0.2785.89.
Does CVE-2016-5160 affect operating systems other than Windows and OS X?
Yes, CVE-2016-5160 also affects Google Chrome on Linux before version 53.0.2785.92.
What is the primary risk associated with CVE-2016-5160?
The primary risk of CVE-2016-5160 is potential unauthorized access to resources through IFRAME elements.