PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5214 Google CVE debrief

CVE-2016-5214 describes a Google Chrome for Windows issue where a crafted HTML page could cause a downloaded file to miss the Mark of the Web (MOTW). That can weaken downstream Windows security prompts and trust decisions for files acquired through the browser. The issue is rated medium severity in the supplied record and requires user interaction.

Vendor
Google
Product
CVE-2016-5214
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-19
Original CVE updated
2026-05-13
Advisory published
2017-01-19
Advisory updated
2026-05-13

Who should care

Windows endpoint defenders, browser management teams, and organizations that rely on Mark of the Web or download-based execution controls should care most. Users on Chrome for Windows prior to the fixed release are the primary exposure group.

Technical summary

The supplied record says Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files such that a remote attacker, via a crafted HTML page, could prevent the downloaded file from receiving MOTW. NVD classifies the weakness as CWE-19 and gives a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating a network-reachable issue that depends on user interaction and has limited integrity impact.

Defensive priority

Moderate. The risk is not high-impact in the CVSS sense, but it can reduce a key Windows safety signal for downloaded content. Prioritize patching browser clients and validating that download provenance controls remain effective.

Recommended defensive actions

  • Update Google Chrome on Windows to the fixed version or later, using your standard browser management channel.
  • Verify that endpoint patching covers all Chrome installations, including unmanaged or rarely used desktops.
  • Review any controls that depend on Mark of the Web or download-zone markings, and confirm they are still enforced after browser updates.
  • Monitor downstream vendor advisories and release notes referenced in the record for any deployment guidance or related fixes.
  • If you use application allowlisting or attachment controls, treat browser-delivered downloads as untrusted unless independently validated.

Evidence notes

All statements are based on the supplied CVE record and its listed official/vendor references. The record states the Windows-only download/MOTW behavior, the affected Chrome versions, the CVSS vector, and the CWE-19 classification. NVD also lists vendor references including Chrome release notes, a Chromium bug, and downstream advisories from Red Hat and Gentoo.

Official resources

The CVE record was published on 2017-01-19 and later modified on 2026-05-13. The supplied source references indicate vendor and downstream advisories were available as part of the original disclosure trail.