# CVE-2016-5217: Google Chrome site isolation bypass in extensions API and PDFium

Source: https://junglewise.ai/threats/cve-2016-5217-google-chrome-site-isolation-bypass-in-extensions-api-and-pdfium  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-19. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-5217 · Severity: medium · CVSS 6.5 · Published 2017-01-19

A security flaw in Google Chrome's extensions and PDF viewing components could allow a malicious website to bypass security boundaries. By tricking a user into visiting a specially crafted web page, an attacker could gain unauthorized access to internal browser functions. This could lead to a compromise of the browser's site isolation protections, which are designed to keep data from different websites separate.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google Chromium](https://junglewise.ai/threats/technologies/chromium). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2016-5217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-5217 being exploited in the wild.

**How severe is CVE-2016-5217?** Medium severity, with a CVSS score of 6.5, published 19 January 2017.

**Which products and versions are affected?** Google Chromium < 55.0.2883.75.

**Is there a fix for CVE-2016-5217?** A patch was published on 2016-12-01: Chrome 55.0.2883.75 released for desktop Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-5217 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-5217?** Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability exists in the extensions API and PDFium component of Google Chrome. The flaw stems from the use of unvalidated data which incorrectly permitted access to privileged plugins. A remote attacker can exploit this by hosting a crafted HTML page; if a user visits this page, the attacker can bypass site isolation mechanisms. This bypass could allow the attacker to interact with browser components or data that should be restricted to a higher privilege level. The issue was addressed in Chrome version 55.0.2883.75 for desktop and 55.0.2883.84 for Android.

## Affected products

- Google Chrome < 55.0.2883.75 (Desktop); < 55.0.2883.84 (Android)
- Google Chromium < 55.0.2883.75

## Timeline

- 2016-12-01: patched: Chrome 55.0.2883.75 released for desktop
- 2016-12-05: advisory: Gentoo GLSA 201612-11 published
- 2016-12-07: advisory: Red Hat RHSA-2016:2919 published
- 2017-01-19: disclosed: NVD publication date

## References

- [http://rhn.redhat.com/errata/RHSA-2016-2919.html](http://rhn.redhat.com/errata/RHSA-2016-2919.html)
- [http://www.securityfocus.com/bid/94633](http://www.securityfocus.com/bid/94633)
- [https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html](https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html)
- [https://crbug.com/654280](https://crbug.com/654280)
- [https://security.gentoo.org/glsa/201612-11](https://security.gentoo.org/glsa/201612-11)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)