CVE-2016-5142

Critical

Published: 07/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Web Cryptography API (WebCrypto) implementation in Blink, used in Google Chrome before version 52.0.2743.116, does not properly copy data buffers. This may allow remote attackers to cause a denial of service (use-after-free) or potentially have unspecified other impact via crafted JavaScript code.

Risk Assessment

This vulnerability may lead to denial of service, affecting the availability of web applications. There is also a risk of unspecified impact on system security.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Additionally, monitoring and restricting the execution of unknown JavaScript code may help minimize risk.

Original NVD description (English source)

The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.