PT-2017-1061 · Google · Google Chrome

Phil Oester · Published 2017-01-19 · Updated 2017-01-20 · CVE-2016-5197

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.85 for Android

Description The issue is related to insufficient validation of intent URLs in the content view client, allowing a remote attacker who has compromised the renderer process to start arbitrary activity on the system via a crafted HTML page. This could also enable a remote attacker to bypass certificate validation using a specially crafted HTML page.

Recommendations For Google Chrome versions prior to 54.0.2840.85 for Android, update to version 54.0.2840.85 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-00153

CVE-2016-5197

Affected Products

Google Chrome

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-5197 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5197 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00153 · Security Note
• https://crbug.com/659477 · Note
• http://securityfocus.com/bid/94078 · Note
• https://chromereleases.googleblog.com/2016/10/chrome-for-android-update_31.html · Note