CVE-2005-4900: google chrome Inadequate Encryption Strength
Vulnerability summary
CVE-2005-4900 is a medium (CVSS 5.9) Inadequate Encryption Strength vulnerability in google chrome. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 59.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 14-10-2016PublishedVulnerability first disclosed.
- 22-05-2026Last modifiedVulnerability information updated.
Description
SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
-0.01 pp
From 0.94% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
Affected systems
Google1 product
- chrome≤ 47.0.2526.111
Opensuse1 product
- sha1collisiondetection&distro=openSUSE Tumbleweed< 1.0.3-4.12
2 vendors · 2 products
References
12 links- shattered.ioX Refsource MISC
- security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.htmlX Refsource MISCThird Party Advisory
Show all 12 references
- kc.mcafee.com/corporate/index?page=content&id=SB10340X Refsource CONFIRM