CVE-2016-7152
Medium · 5.3CVSS
5.3
EPSS
12.8%
Published
Sep 6, 2016
CISA due date
—
The record
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | chromium | 0 | 0 |
| Chainguard | chromium-docker-selenium-compat | 0 | 0 |
| Chainguard | chromium-lang | 0 | 0 |
| Chainguard | chromium-qt | 0 | 0 |
| Chainguard | firefox | 0 | 0 |
| Ubuntu:16.04:LTS | oxide-qt | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | oxide-qt | 0 | No fix |
| Wolfi | chromium | 0 | 0 |
| Wolfi | chromium-docker-selenium-compat | 0 | 0 |
| Wolfi | chromium-lang | 0 | 0 |
| Wolfi | chromium-qt | 0 | 0 |
| Wolfi | firefox | 0 | 0 |
Related vulnerabilities
- CVE-2026-4453 Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote… Also affects chromium
- CVE-2026-3942 Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed… Also affects chromium
- CVE-2026-3934 Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3936 Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a… Also affects chromium
- CVE-2026-3938 Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3940 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3941 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3935 Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a… Also affects chromium