CVE-2017-5118 — Incorrect Permission Assignment in Google Chrome

CWE-732 — Incorrect Permission Assignment6 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 44.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Google ChromeDebian LinuxRedhat Enterprise Linux Desktop+2 more
Timeline
PublishedOct 27
Latest updateMay 13

Description

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDgoogle/chrome< 61.0.3163.79+1

Also affects: Debian Linux 10.0, 9.0

🔴Vulnerability Details

2
GHSA
GHSA-4rqg-fm5f-cc59: Blink in Google Chrome prior to 61↗2022-05-13
▶
OSV
CVE-2017-5118: Blink in Google Chrome prior to 61↗2017-10-27
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: bypass of content security policy in blink↗2017-09-05
▶

💬Community

2
Bugzilla
CVE-2017-5111 CVE-2017-5112 CVE-2017-5113 CVE-2017-5114 CVE-2017-5115 CVE-2017-5116 CVE-2017-5117 CVE-2017-5118 CVE-2017-5119 CVE-2017-5120 chromium: various flaws [fedora-all]↗2017-09-06
▶
Bugzilla
CVE-2017-5118 chromium-browser: bypass of content security policy in blink↗2017-09-06
▶