CVE-2016-5135

CVE-2016-5135 describes a vulnerability in WebKit's HTMLPreloadScanner, affecting Google Chrome versions prior to 52.0.2743.82. It allows remote attackers to bypass Content Security Policy (CSP) protections by manipulating referrer-policy information within an HTML document, specifically when a meta tag attempts to override a referrer header. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and requires user interaction, potentially leading to high integrity impacts by allowing information disclosure. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage, indicating awareness.