Medium severity6.1NVD Advisory· Published Feb 17, 2017· Updated Jun 17, 2026

CVE-2017-5018

Description

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Chrome
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Range: <=55.0.2883.87
osv-coords2 versions
pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2012%20SP2
< 93.0.4577.82-1.1+ 1 more
- (no CPE)range: < 93.0.4577.82-1.1
- (no CPE)range: < 56.0.2924.87-5.1

Patches

Vulnerability mechanics

References

rhn.redhat.com/errata/RHSA-2017-0206.htmlnvd
www.debian.org/security/2017/dsa-3776nvd
www.securityfocus.com/bid/95792nvd
www.securitytracker.com/id/1037718nvd
chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.htmlnvd
crbug.com/668665nvd
security.gentoo.org/glsa/201701-66nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000