CVE-2017-5010: XSS
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 56.0.2924.76 - Upgrade
Upgrade
Google Chrome (Android)to a version that resolves this vulnerability.Fixed in 56.0.2924.87
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5010?
CVE-2017-5010 has a medium severity rating due to the potential for remote code execution via UXSS attacks.
How do I fix CVE-2017-5010?
To fix CVE-2017-5010, upgrade Google Chrome to version 56.0.2924.76 or later.
Which versions of Google Chrome are affected by CVE-2017-5010?
CVE-2017-5010 affects Google Chrome versions prior to 56.0.2924.76 for desktop and 56.0.2924.87 for Android.
What kind of attack is possible with CVE-2017-5010?
CVE-2017-5010 allows remote attackers to inject arbitrary scripts or HTML through a crafted HTML page.
Is the Linux version of Google Chrome vulnerable to CVE-2017-5010?
Yes, the Linux version of Google Chrome prior to 56.0.2924.76 is vulnerable to CVE-2017-5010.