CVE-2017-5033: Medium severity Google Chrome vulnerability
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 57.0.2987.98 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 57.0.2987.108
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5033?
CVE-2017-5033 is rated as high severity due to its ability to bypass content security policies.
How do I fix CVE-2017-5033?
To fix CVE-2017-5033, update Google Chrome to version 57.0.2987.98 or later.
Which versions of Google Chrome are affected by CVE-2017-5033?
CVE-2017-5033 affects Google Chrome versions prior to 57.0.2987.98.
What types of systems are affected by CVE-2017-5033?
CVE-2017-5033 affects Google Chrome on Mac, Windows, Linux, and Android platforms.
Can CVE-2017-5033 affect local scheme pages?
Yes, CVE-2017-5033 allows for the bypassing of content security policy on local scheme pages.