CVE-2017-5018

Description

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.

References

https://security.gentoo.org/glsa/201701-66

https://crbug.com/668665

https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html

http://www.securitytracker.com/id/1037718

http://www.securityfocus.com/bid/95792

http://www.debian.org/security/2017/dsa-3776

http://rhn.redhat.com/errata/RHSA-2017-0206.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3