Launchpad.net

CVE 2016-5130

content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site.

See the CVE page on Mitre.org for more details.