CVE-2017-5118

medium

Description

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.

References

https://crbug.com/747847

https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html

https://security.gentoo.org/glsa/201709-15

http://www.securitytracker.com/id/1039291

http://www.securityfocus.com/bid/100610

http://www.debian.org/security/2017/dsa-3985

https://access.redhat.com/errata/RHSA-2017:2676

Details

Source: MITRE

Published: 2017-10-27

Updated: 2022-04-06

Type: CWE-732

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 2.8

Severity: MEDIUM