What is CVE-2016-1617?

CVE-2016-1617 is a medium-severity vulnerability in Google Chrome, classified under Information Disclosure. CVSS score: 4.3/10. Published 2016-01-25.

How severe is CVE-2016-1617?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2016-1617 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Google Chrome

CVE-2016-1617

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.

Vulnerability class: Information Disclosure

Published 2016-01-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.013 (68.9th percentile), scored 2026-10-07.

Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000

Affected products

Google Chrome

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

References

www.securityfocus.com/bid/81430 (vdb-entry)
rhn.redhat.com/errata/RHSA-2016-0072.html (vendor-advisory)
codereview.chromium.org/1455973003
www.ubuntu.com/usn/USN-2877-1 (vendor-advisory)
googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html
www.securitytracker.com/id/1034801 (vdb-entry)
lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html (vendor-advisory)
security.gentoo.org/glsa/201603-09 (vendor-advisory)
lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html (vendor-advisory)
www.debian.org/security/2016/dsa-3456 (vendor-advisory)

Frequently asked questions

What is CVE-2016-1617?: CVE-2016-1617 is a medium-severity vulnerability in Google Chrome, classified under Information Disclosure. CVSS score: 4.3/10. Published 2016-01-25.
How severe is CVE-2016-1617?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2016-1617 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.