CVE-2016-10557: Insecure Resource Download in appium-chromedriver
Summary
CVE-2016-10557: appium-chromedriver downloads Resources over HTTP. Affects appium-chromedriver versions < 2.9.4. Fixed in 2.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
appium-chromedriver is an npm package that is used as a WebDriver server for Appium, a mobile automation framework. It allows users to automate the testing of mobile applications on various platforms. The package includes the chromedriver binary, which is responsible for controlling the Chrome browser during automated tests. However, prior to version 2.9.4, appium-chromedriver insecurely downloaded resources over HTTP, making it vulnerable to attacks.
Vulnerability Detail
The vulnerability in appium-chromedriver arises from the insecure downloading of resources over HTTP. If an attacker has a privileged network position, they can intercept and modify the items sent over HTTP. In this case, the chromedriver binary can be overwritten with a malicious binary, potentially leading to remote code execution. This vulnerability has a high severity rating (CWE-311) and can be exploited by an attacker with network access to the affected system.
How To Fix
Latest published version: 9.1.5 as of 22 Oct 2026
npm install appium-chromedriver@9.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.4
This is the first release that contains the fix.
npm install appium-chromedriver@2.9.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in appium-chromedriver that allows insecure resource downloads over HTTP can be mitigated by updating to version 2.9.4 or later. It is crucial to promptly address this vulnerability to prevent potential remote code execution attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for appium-chromedriver →
FAQ
appium-chromedriver is an npm package used as a WebDriver server for Appium, enabling automated testing of mobile applications on various platforms.
The vulnerability allows an attacker with network access to intercept and modify the chromedriver binary, potentially leading to remote code execution.
Updating to version 2.9.4 or later of appium-chromedriver will fix the vulnerability by ensuring secure resource downloads over HTTPS.
No workaround is available for this vulnerability. It is recommended to update to the fixed version of appium-chromedriver.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-hc94-2wfr-4pwf.
