CVE-2017-5078 : Security Advisory and Response

Google Chrome prior to version 59.0.3071.86 for Linux, Windows, and Mac was vulnerable to a command injection exploit through the handling of untrusted input in Blink's mailto feature.

Understanding CVE-2017-5078

What is CVE-2017-5078?

The vulnerability in Google Chrome allowed a remote attacker to execute arbitrary commands by exploiting a crafted HTML page.

The Impact of CVE-2017-5078

The vulnerability could be exploited to perform command injection, similar to a known issue (CVE-2004-0121), enabling attackers to execute arbitrary commands remotely.

Technical Details of CVE-2017-5078

Vulnerability Description

Insufficient validation of untrusted input in Blink's mailto feature in Google Chrome prior to 59.0.3071.86

Affected Systems and Versions

Google Chrome versions prior to 59.0.3071.86 for Linux, Windows, and Mac

Exploitation Mechanism

Remote attackers could leverage a crafted HTML page to execute arbitrary commands through command injection.

Mitigation and Prevention

Immediate Steps to Take

Update Google Chrome to version 59.0.3071.86 or later
Avoid clicking on suspicious links or visiting untrusted websites

Long-Term Security Practices

Regularly update software and applications to patch known vulnerabilities
Implement security best practices to prevent command injection attacks

Patching and Updates

Google released a stable channel update addressing this vulnerability in June 2017