← Back

CVE-2016-7153

nvd nist
Published: Sep 6, 2016Modified: May 6, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.

Affected (6)

Products: Microsoft: Edge, Internet Explorer · Google: Chrome · Apple: Safari · +2 more
Show all products
Microsoft: Edge, Internet Explorer · Google: Chrome · Apple: Safari · Opera: Opera Browser · Mozilla: Firefox
Microsoft
2 products
Edge
Internet Explorer
Google
1 product
Chrome
Apple
1 product
Safari
Opera
1 product
Opera Browser
Mozilla
1 product
Firefox
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Edge
All versions
Internet Explorer
All versions
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Chrome
All versions
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Safari
All versions
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Opera Browser
All versions
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Firefox
All versions

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (18)

Source: cve@mitre.org
Technical Description
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Technical Description
Source: af854a3a-2127-422b-91ae-364da2661108
Technical Description
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Technical Description

Timeline

No history available yet.