CVE-2016-5218: Input Validation
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox (URL bar) via a crafted HTML page containing PDF data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5218?
CVE-2016-5218 has a medium severity rating due to its potential to spoof URL contents through crafted PDF data.
How do I fix CVE-2016-5218?
To fix CVE-2016-5218, you should update Google Chrome to version 55.0.2883.75 or later on Mac, Windows, and Linux, or version 55.0.2883.84 or later on Android.
What does CVE-2016-5218 affect?
CVE-2016-5218 affects Google Chrome versions prior to 55.0.2883.75 on desktop and prior to 55.0.2883.84 on Android.
What is the attack vector for CVE-2016-5218?
The attack vector for CVE-2016-5218 is a crafted HTML page containing PDF data that can temporarily spoof the URL bar.
Who can exploit CVE-2016-5218?
CVE-2016-5218 can be exploited by remote attackers who can deliver the malicious crafted HTML page to unsuspecting users.