CVE-2017-5085: XSS
Inappropriate implementation in Bookmarks in Google Chrome prior to 59 for iOS allowed a remote attacker who convinced the user to perform certain operations to run JavaScript on chrome:// pages via a crafted bookmark.
Other sources
The following flaw was identified in the Chromium browser: inappropriate javascript execution on webui pages.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=692378
External References:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5085?
CVE-2017-5085 has been classified as a high-severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2017-5085?
To fix CVE-2017-5085, update Google Chrome to version 59.0.3071.86 or later.
Which versions of Google Chrome are affected by CVE-2017-5085?
CVE-2017-5085 affects Google Chrome versions prior to 59.0.3071.86.
Can CVE-2017-5085 lead to data theft?
Yes, CVE-2017-5085 could potentially allow an attacker to execute JavaScript on chrome:// pages, which may lead to data theft.
What operations can trigger CVE-2017-5085?
CVE-2017-5085 is triggered when a user performs specific operations involving crafted bookmarks.