CVE-2017-5020: XSS
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 56.0.2924.76 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 56.0.2924.87
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5020?
CVE-2017-5020 has been rated as high severity due to its potential for remote code execution.
How do I fix CVE-2017-5020?
To fix CVE-2017-5020, you should update Google Chrome to version 56.0.2924.76 or later.
What platforms are affected by CVE-2017-5020?
CVE-2017-5020 affects Google Chrome on Linux, Windows, Mac, and Android prior to the specified versions.
What kind of attacks are possible with CVE-2017-5020?
CVE-2017-5020 allows attackers to install malicious extensions and execute arbitrary code on the victim's machine.
Is user interaction required for CVE-2017-5020 exploitation?
Exploitation of CVE-2017-5020 requires user interaction, specifically convincing the user to install a malicious extension.