Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5141.json"
[ { "events": [ { "introduced": "0" }, { "last_affected": "52.0.2743.82" } ] } ]