CVE-2016-5166: Google Chrome

Low severity, CVSS 3.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice.

Affected products

• Google Chrome: up to and including 52.0.2743.116
• Opensuse Leap: version 42.1 only

Published 2016-09-11. Last modified 2026-06-17.