Cloudanix VulnDB

CVE-2016-5204

Medium · 6.1

CVSS

6.1

EPSS

1.2%

Published

Jan 19, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An older version of Chrome could let attackers secretly run their own code on other websites you visit, which might let them steal information or take over accounts.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Leaking of an SVG shadow tree corrupts the DOM tree in Blink, enabling remote injection of arbitrary scripts or HTML across origins via UXSS.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive data displayed in the browser, or perform unauthorized actions on behalf of victims using Chrome, increasing risk of data breaches and compliance violations especially in environments with many unpatched browsers.

How an attack unfolds

An attacker hosts a crafted HTML page containing SVG elements that trigger shadow tree leakage. When a victim visits the page in a vulnerable Chrome release, DOM corruption occurs and permits cross-origin script or HTML injection without user interaction beyond page load.

How to fix it

Upgrade Google Chrome to version 55.0.2883.75 or later on Mac, Windows, and Linux, and to 55.0.2883.84 or later on Android. Apply updates through enterprise management tools where available and verify installation across all endpoints.

How to confirm the fix worked

Confirm Chrome version via chrome://version meets or exceeds the fixed releases. Re-test affected SVG rendering scenarios with known trigger pages in a lab environment and ensure no residual vulnerable binaries remain in deployment pipelines.

Typical attack path

  1. Craft malicious HTML page embedding SVG designed to leak shadow tree
  2. Host page on attacker-controlled web server
  3. Lure target user to visit the page via phishing or compromised site
  4. Browser renders SVG and leaks shadow tree into main DOM
  5. Injected script executes in victim origin context
  6. Attacker exfiltrates data or performs actions via injected code

How to detect it

Examine web server access logs and browser telemetry for requests to attacker-hosted pages containing unusual SVG structures; review Chrome process execution and crash reports for DOM-related anomalies around the publication timeframe; correlate with any observed cross-origin script loads lacking proper CSP violations.

What your security team should do

  • Immediately deploy Chrome updates to all managed and unmanaged endpoints
  • Block or isolate traffic from known malicious domains used in historical campaigns
  • Enable enterprise policies to enforce automatic updates and disable outdated channels
  • Review web proxy and browser telemetry logs for anomalous cross-origin activity

The record

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Affected packages

Ecosystem Package Introduced Fixed
Debian:8 chromium-browser 0 55.0.2883.75-1~deb8u1
Mageia:5 chromium-browser-stable 0 55.0.2883.87-1.mga5
Red Hat:rhel_extras:6 chromium-browser 0 0:55.0.2883.75-1.el6
Red Hat:rhel_extras:6 chromium-browser-debuginfo 0 0:55.0.2883.75-1.el6
SUSE:Package Hub 12 SP2 chromium 0 55.0.2883.75-2.1
Ubuntu:14.04:LTS chromium-browser 0 58.0.3029.81-0ubuntu0.14.04.1172
Ubuntu:14.04:LTS oxide-qt 0 1.19.4-0ubuntu0.14.04.1
Ubuntu:16.04:LTS chromium-browser 0 55.0.2883.87-0ubuntu0.16.04.1263
Ubuntu:16.04:LTS oxide-qt 0 1.19.4-0ubuntu0.16.04.1
openSUSE:Tumbleweed chromium 0 113.0.5672.92-1.1
openSUSE:Tumbleweed chromium 0 55.0.2883.75-3.1

Related vulnerabilities