CVE-2016-5193 Security feature bypass in Chrome prior to 54.0 for iOS
Remote attackers can bypass URL scheme navigation restrictions in Chrome for iOS by crafting malicious HTML pages, requiring users to update the browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-5193?
CVE-2016-5193 is a medium-severity vulnerability in Google Chrome, published on 18 Dec 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages.
Weakness: CWE-20
Which versions are affected by CVE-2016-5193?
It affects 1 product.
Products include Google Chrome.
How do I fix CVE-2016-5193?
Upgrade to a fixed version.
Is CVE-2016-5193 being exploited?
There is no known exploitation of CVE-2016-5193 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome
Sources
Also known as GHSA-8vpq-vv9q-59cq.