CVE-2016-1684

CVE-2016-1684 is a denial-of-service vulnerability in libxslt versions prior to 1.1.29, including its use in Google Chrome before 51.0.2704.63. It stems from improper handling of the 'i' format token for xsl:number data, allowing remote attackers to trigger an integer overflow or resource exhaustion via a crafted document. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector, high attack complexity, and requires user interaction, potentially leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it garnered some community discussion and media coverage at the time.