CVE-2017-5026 — UI Misrepresentation / Clickjacking in Google Chrome

CWE-1021 — UI Misrepresentation / Clickjacking8 documents6 sources
Severity
4.3MEDIUMNVD
OSV6.1
EPSS
0.6%
top 30.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedFeb 17
Latest updateMay 13

Description

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶NVDgoogle/chrome55.0.2883.87

🔴Vulnerability Details

3
GHSA
GHSA-5vf2-fr7j-rf7r: Google Chrome prior to 56↗2022-05-13
▶
OSV
oxide-qt vulnerabilities↗2017-02-08
▶
OSV
CVE-2017-5026: Google Chrome prior to 56↗2017-01-27
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2017-02-08
▶
Red Hat
chromium-browser: ui spoofing↗2017-01-25
▶

💬Community

2
Bugzilla
CVE-2017-5026 chromium-browser: ui spoofing↗2017-01-26
▶
Bugzilla
chromium: various flaws [fedora-all]↗2017-01-26
▶