CVE-2017-5016 — UI Misrepresentation / Clickjacking in Google Chrome

CWE-1021 — UI Misrepresentation / Clickjacking6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 30.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedFeb 17
Latest updateMay 13

Description

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a crafted HTML page.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDgoogle/chrome55.0.2883.87

🔴Vulnerability Details

2
GHSA
GHSA-38h4-4x7h-qprw: Blink in Google Chrome prior to 56↗2022-05-13
▶
OSV
CVE-2017-5016: Blink in Google Chrome prior to 56↗2017-02-17
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: ui spoofing in blink↗2017-01-25
▶

💬Community

2
Bugzilla
CVE-2017-5016 chromium-browser: ui spoofing in blink↗2017-01-26
▶
Bugzilla
chromium: various flaws [fedora-all]↗2017-01-26
▶