CVE-2016-7153
Medium · 5.3CVSS
5.3
EPSS
12.8%
Published
Sep 6, 2016
CISA due date
—
The record
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | chromium | 0 | 0 |
| Chainguard | chromium-docker-selenium-compat | 0 | 0 |
| Chainguard | chromium-lang | 0 | 0 |
| Chainguard | chromium-qt | 0 | 0 |
| Chainguard | firefox | 0 | 144.0.2-r0 |
| Ubuntu:16.04:LTS | oxide-qt | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | oxide-qt | 0 | No fix |
| Wolfi | chromium | 0 | 0 |
| Wolfi | chromium-docker-selenium-compat | 0 | 0 |
| Wolfi | chromium-lang | 0 | 0 |
| Wolfi | chromium-qt | 0 | 0 |
| Wolfi | firefox | 0 | 144.0.2-r0 |
Related vulnerabilities
- CVE-2026-4453 Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote… Also affects chromium
- CVE-2026-3942 Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed… Also affects chromium
- CVE-2026-3934 Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3936 Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a… Also affects chromium
- CVE-2026-3938 Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3940 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3941 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71… Also affects chromium
- CVE-2026-3935 Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a… Also affects chromium