CVE-2016-5196

High

Published: 19/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The content renderer client in Google Chrome prior to version 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, allowing a remote attacker to access any downloaded file and interact with sites, including those the user was logged into, via a crafted HTML page.

Risk Assessment

An attacker could gain access to sensitive user data and perform unauthorized actions on sites where the user is logged in, posing a serious threat to data security.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring downloaded files.

Other vulnerabilities in Google Chrome for Android

CVE-2016-5197High
The content view client in Google Chrome prior to version 54.0.2840.85 for Android insufficiently validated intent URLs, allowing a remote attacker who compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.

Original NVD description (English source)

The content renderer client in Google Chrome prior to 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, which allowed a remote attacker to access any downloaded file and interact with sites, including those the user was logged into, via a crafted HTML page.