CVE-2017-5018: XSS
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5018?
CVE-2017-5018 is rated as a high-severity vulnerability due to its potential for remote script injection.
How do I fix CVE-2017-5018?
To fix CVE-2017-5018, upgrade Google Chrome to version 56.0.2924.76 or later for affected platforms.
Which versions of Google Chrome are affected by CVE-2017-5018?
CVE-2017-5018 affects Google Chrome versions prior to 56.0.2924.76 for Linux, Windows, and Mac, and prior to 56.0.2924.87 for Android.
What type of attack is possible with CVE-2017-5018?
CVE-2017-5018 allows remote attackers to inject scripts or HTML into a privileged page by exploiting a weak content security policy.
Can CVE-2017-5018 lead to data loss or theft?
Yes, CVE-2017-5018 may lead to data loss or theft as it allows for script injection on privileged pages.