PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5224 Google CVE debrief

CVE-2016-5224 is a medium-severity Google Chrome vulnerability involving a timing attack on denormalized floating point arithmetic in SVG filters in Blink. According to the CVE description, a remote attacker could use a crafted HTML page to help bypass the Same Origin Policy. Google’s remediation is referenced in the record for Chrome desktop and Android builds, and the issue is tied to browser versions before the fixed releases.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-19
Original CVE updated
2026-05-13
Advisory published
2017-01-19
Advisory updated
2026-05-13

Who should care

Security teams managing Google Chrome on desktop or Android, browser fleet administrators, and users on affected Chrome releases should prioritize this advisory. It is especially relevant wherever browser-based access to sensitive web applications is common.

Technical summary

The NVD record classifies the issue as CWE-189 and gives a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability centers on timing behavior in Blink’s SVG filter handling, where denormalized floating point arithmetic could leak information sufficient to bypass the Same Origin Policy when a user visits a crafted HTML page. Google’s description names fixed releases of 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android.

Defensive priority

Medium. The issue requires user interaction, but it affects a core browser isolation control and can expose same-origin data if a user opens a malicious page. Apply the vendor fixes promptly in managed browser environments.

Recommended defensive actions

  • Update Google Chrome to the fixed release or later on desktop and Android.
  • Verify fleet coverage against the vendor-fixed versions named in the CVE description: 55.0.2883.75 for Mac/Windows/Linux and 55.0.2883.84 for Android.
  • Treat this as a browser isolation issue and prioritize it on systems that access sensitive internal web applications.
  • Use browser update policies and compliance checks to confirm that affected endpoints are no longer on vulnerable Chrome builds.
  • Track vendor release notes and browser security advisories as part of routine patch management.

Evidence notes

The source record is an official NVD CVE entry published on 2017-01-19 and later modified on 2026-05-13. Its metadata cites Google’s Chrome Releases stable channel update for desktop and the Chromium bug tracker (crbug.com/615851) among the references, along with Red Hat, SecurityFocus, and Gentoo advisories. NVD lists Chrome as vulnerable up to 54.0.2840.99 in its CPE criteria, while the CVE description specifies the fixed Chrome releases as 55.0.2883.75 on desktop platforms and 55.0.2883.84 on Android.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5224 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5224

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5224 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5224

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.