CVE-2016-5142
Last modified
CVE-2016-5142 is a vulnerability of currently unknown severity. The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.. EPSS estimates a 1.68% chance of exploitation in the next 30 days.
Description
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chrome | <= 52.0.2743.82 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-5142?
How severe is CVE-2016-5142?
How do I fix CVE-2016-5142?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-5136Use-after-free vulnerability in extensions/renderer/user_scr…
- CVE-2016-5137The CSPSource::schemeMatches function in WebKit/Source/core/…
- CVE-2016-5138Integer overflow in the kbasep_vinstr_attach_client function…
- CVE-2016-5139Multiple integer overflows in the opj_tcd_init_tile function…
- CVE-2016-5140Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc fun…
- CVE-2016-5141Blink, as used in Google Chrome before 52.0.2743.116, allows…
- CVE-2016-5143The Developer Tools (aka DevTools) subsystem in Blink, as us…
- CVE-2016-5144The Developer Tools (aka DevTools) subsystem in Blink, as us…
- CVE-2016-5145Blink, as used in Google Chrome before 52.0.2743.116, does n…
- CVE-2016-5146Multiple unspecified vulnerabilities in Google Chrome before…
- CVE-2016-5147Blink, as used in Google Chrome before 53.0.2785.89 on Windo…
- CVE-2016-5148Cross-site scripting (XSS) vulnerability in Blink, as used i…
Are you affected by CVE-2016-5142?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST