CVE-2016-5184 is a heap corruption vulnerability in PDFium, affecting Google Chrome versions prior to 54.0.2840.59 on Windows, Mac, and Linux, and 54.0.2840.85 on Android. It arises from incorrect object lifecycle handling in CFFL_FormFillter::KillFocusForAnnot when processing crafted PDF files. This vulnerability carries a high CVSS score of 8.8, indicating a critical risk due to its network attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, suggesting awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 53.0.2785.143CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.