Launchpad.net

CVE 2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.

See the CVE page on Mitre.org for more details.