CVE-2016-7549 — NULL Pointer Dereference in Google Chrome

CWE-476 — NULL Pointer Dereference8 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.9%
top 24.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedSep 25
Latest updateMay 14

Description

Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact by leveraging access to a renderer process, related to render_frame_host_impl.cc and render_widget_host_impl.cc, as demonstrated by a Password Manager message.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDgoogle/chrome53.0.2785.101

🔴Vulnerability Details

3
GHSA
GHSA-qqhx-99jv-jg5r: Google Chrome before 53↗2022-05-14
▶
OSV
oxide-qt vulnerabilities↗2016-10-07
▶
OSV
CVE-2016-7549: Google Chrome before 53↗2016-09-25
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2016-10-07
▶
Red Hat
chromium-browser: DoS via invalid recipient of IPC message↗2016-09-09
▶

💬Community

2
Bugzilla
CVE-2016-7549 chromium: chromium-browser: DoS via invalid recipient of IPC message [fedora-all]↗2016-09-29
▶
Bugzilla
CVE-2016-7549 chromium-browser: DoS via invalid recipient of IPC message↗2016-09-29
▶