CVE-2016-5197
published 2017-01-19CVE-2016-5197: The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had…
PriorityP341high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
0.96%
58.2th percentile
The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 54.0.2840.68 | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 54 on Android Content View Client input validation (BID-94078)
vuldb·2026-05-14·CVSS 8.8
CVE-2016-5197 [HIGH] Google Chrome up to 54 on Android Content View Client input validation (BID-94078)
A vulnerability described as critical has been identified in Google Chrome up to 54 on Android. This impacts an unknown function of the component Content View Client. The manipulation results in improper input validation.
This vulnerability was named CVE-2016-5197. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
GHSA-gf82-7742-3hw8: The content view client in Google Chrome prior to 54
ghsa_unreviewed·2022-05-17
CVE-2016-5197 [HIGH] CWE-20 GHSA-gf82-7742-3hw8: The content view client in Google Chrome prior to 54
The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compromised the renderer process to start arbitrary activity on the system via a crafted HTML page.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-01-19
Published