CVE-2016-5196

8.8HIGH

Key Information:

Vendor
Google
Status
Google Chrome Prior To 54.0.2840.85 For Android
Vendor
CVE Published:
19 January 2017

Summary

The content renderer client in Google Chrome prior to 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, which allowed a remote attacker to access any downloaded file and interact with sites, including those the user was logged into, via a crafted HTML page.

Affected Version(s)

Google Chrome prior to 54.0.2840.85 for Android Google Chrome prior to 54.0.2840.85 for Android

References

https://chromereleases.googleblog.com/2016/10/chrome-for-...
x_refsource_CONFIRM
https://crbug.com/659492
x_refsource_CONFIRM
http://www.securityfocus.com/bid/94078
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.