CVE-2016-5225

CVE-2016-5225 describes a vulnerability in Blink, the rendering engine used in Google Chrome versions prior to 55.0.2883.75 (Mac, Windows, Linux) and 55.0.2883.84 (Android). This flaw allowed a remote attacker to bypass Content Security Policy (CSP) by crafting a malicious HTML page that incorrectly handled form actions. The vulnerability is rated Medium severity (CVSS 4.3), indicating a network-based attack requiring user interaction, with a low impact on integrity and no impact on confidentiality or availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it garnered some community discussion and media coverage at the time.