PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5208 Google CVE debrief

CVE-2016-5208 affects Google Chrome’s Blink engine and was fixed in Chrome 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android. The issue is described as possible corruption of the DOM tree during synchronous event handling. In practical terms, a remote attacker could use a crafted HTML page to inject arbitrary scripts or HTML, resulting in UXSS-style impact. NVD rates the issue CVSS 3.0 6.1 (Medium), reflecting network attack conditions with required user interaction.

Vendor
Google
Product
CVE-2016-5208
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-19
Original CVE updated
2026-05-13
Advisory published
2017-01-19
Advisory updated
2026-05-13

Who should care

Chrome users and administrators on Linux, Windows, and Android, especially those managing browser versions centrally or allowing users to browse untrusted web content.

Technical summary

NVD lists CVE-2016-5208 with CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N and CWE-79. The vulnerability is in Blink, where synchronous event handling could corrupt the DOM tree. The described outcome is arbitrary script or HTML injection via a crafted HTML page, which makes this a browser-origin security boundary issue rather than a denial-of-service-only flaw.

Defensive priority

Medium

Recommended defensive actions

  • Update Google Chrome to 55.0.2883.75 or later on Linux and Windows, and 55.0.2883.84 or later on Android.
  • Verify managed endpoints and browser update channels are actually receiving the fixed builds, not just configured to do so.
  • Check downstream or distro advisories referenced in the record for platform-specific remediation guidance.
  • Prioritize patching for users who regularly access untrusted web content or where browser updates are delayed.

Evidence notes

The source corpus includes the NVD record, which provides the affected version boundary (through 54.0.2840.99), the CVSS vector, and the CWE-79 mapping. Google-linked references in the record point to the Chrome stable channel update, Chromium issue 658535, and downstream advisories from Red Hat and Gentoo. This debrief relies only on those official references and the supplied CVE metadata.

Official resources

Publicly published on 2017-01-19 in the CVE/NVD record set, with Google-linked release and downstream advisories cited in the references. Timing in this debrief follows the CVE published date supplied here, not the later modified date.