View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-7152 low priority: Ubuntu including 4 source packages (chromium-browser, firefox, oxide-qt, thunderbird), 24 status rows across 6 suites (precise, trusty, upstream, xenial, yakkety, zesty): ignored 15, DNE 5, needed 2, needs-triage 2.
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.