PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5205 Google CVE debrief

CVE-2016-5205 is a Chrome/Blink client-side security issue that could let a remote attacker inject arbitrary scripts or HTML through a crafted HTML page. The NVD record classifies it as CWE-79 and gives it a medium CVSS 3.0 score of 6.1 with network attack vector and user interaction required. For defenders, the key concern is browser exposure on desktop fleets running affected Chrome versions, especially where users may open untrusted web content.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-19
Original CVE updated
2026-05-13
Advisory published
2017-01-19
Advisory updated
2026-05-13

Who should care

Organizations and users running Google Chrome on Linux, Windows, or macOS should care, especially desktop fleets that allow browsing of untrusted content. Security and endpoint teams should prioritize patch validation for managed browsers and any downstream distributions that package Chrome updates.

Technical summary

The NVD description states that Blink in Google Chrome prior to 55.0.2883.75 incorrectly handled deferred page loads, enabling arbitrary script or HTML injection via a crafted HTML page. NVD maps the issue to CWE-79 and lists the vulnerable Chrome range as versions up to 54.0.2840.99. The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which reflects remote reachability but requires user interaction and can affect confidentiality and integrity.

Defensive priority

Medium. The issue is remotely reachable and can lead to script/HTML injection in the browser context, but it requires a user to interact with crafted content and does not indicate availability impact. Patch promptly on exposed desktop fleets and verify browser version compliance.

Recommended defensive actions

  • Update Google Chrome to 55.0.2883.75 or later on Linux, Windows, and macOS.
  • Confirm fleet versions are not in the vulnerable Chrome range identified by NVD (through 54.0.2840.99).
  • Review downstream vendor advisories and package repositories for the corresponding browser fix if you deploy Chromium-based packages.
  • Prioritize remediation for users with broad web access or elevated trust in browser content, since the issue requires user interaction with a crafted page.
  • Use managed update channels and compliance checks to confirm the fix is deployed across the desktop estate.

Evidence notes

The debrief is based on the NVD CVE record and vendor references included in the source corpus. NVD states: Chrome prior to 55.0.2883.75 on Linux, Windows, and Mac incorrectly handled deferred page loads, allowing arbitrary script or HTML injection via a crafted HTML page. NVD also lists CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79, and vulnerable CPE criteria through 54.0.2840.99. The reference set includes Google Chrome Stable Channel update notes, a Chromium issue tracker entry, and downstream advisories from Red Hat and Gentoo, supporting the remediation context without adding unsupported claims.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5205 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5205

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5205 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5205

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.