# CVEs published 2016-07-23

18 CVEs were published on July 23, 2016: 0 critical, 1 high. Days are UTC.

- [CVE-2016-1705](https://cve.now/CVE-2016-1705.md): Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2016-1706](https://cve.now/CVE-2016-1706.md): The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that (no CVSS)
- [CVE-2016-1707](https://cve.now/CVE-2016-1707.md): ios/web/web\_state/ui/crw\_web\_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with (no CVSS)
- [CVE-2016-1708](https://cve.now/CVE-2016-1708.md): The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly c (no CVSS)
- [CVE-2016-1709](https://cve.now/CVE-2016-1709.md): Heap-based buffer overflow in the ByteArray::Get method in data/byte\_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome b (no CVSS)
- [CVE-2016-1710](https://cve.now/CVE-2016-1710.md): The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, (no CVSS)
- [CVE-2016-1711](https://cve.now/CVE-2016-1711.md): WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a (no CVSS)
- [CVE-2016-5127](https://cve.now/CVE-2016-5127.md): Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows r (no CVSS)
- [CVE-2016-5128](https://cve.now/CVE-2016-5128.md): objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a (no CVSS)
- [CVE-2016-5129](https://cve.now/CVE-2016-5129.md): Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remo (no CVSS)
- [CVE-2016-5130](https://cve.now/CVE-2016-5130.md): content/renderer/history\_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward (no CVSS)
- [CVE-2016-5131](https://cve.now/CVE-2016-5131.md): Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a deni (CVSS 8.8)
- [CVE-2016-5132](https://cve.now/CVE-2016-5132.md): The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during deci (no CVSS)
- [CVE-2016-5133](https://cve.now/CVE-2016-5133.md): Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spo (no CVSS)
- [CVE-2016-5134](https://cve.now/CVE-2016-5134.md): net/proxy/proxy\_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information (no CVSS)
- [CVE-2016-5135](https://cve.now/CVE-2016-5135.md): WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-pol (no CVSS)
- [CVE-2016-5136](https://cve.now/CVE-2016-5136.md): Use-after-free vulnerability in extensions/renderer/user\_script\_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 (no CVSS)
- [CVE-2016-5137](https://cve.now/CVE-2016-5137.md): The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in B (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.