CVE-2017-5118 : Security Advisory and Response

Google Chrome versions before 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android had a vulnerability in the Blink engine that allowed a remote attacker to bypass content security policy.

Understanding CVE-2017-5118

This CVE entry pertains to a security vulnerability in Google Chrome that could be exploited by a remote attacker.

What is CVE-2017-5118?

CVE-2017-5118 is a vulnerability in Google Chrome versions prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android. The issue lies in the Blink engine, causing a failure to propagate CSP restrictions correctly to javascript scheme pages.

The Impact of CVE-2017-5118

The vulnerability allowed a malicious HTML page to bypass content security policy, potentially enabling exploitation by a remote attacker.

Technical Details of CVE-2017-5118

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The vulnerability in Google Chrome prior to version 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to bypass content security policy via a crafted HTML page.

Affected Systems and Versions

Google Chrome versions before 61.0.3163.79 for Mac, Windows, and Linux
Google Chrome version 61.0.3163.81 for Android

Exploitation Mechanism

The issue in the Blink engine led to the incorrect propagation of CSP restrictions to javascript scheme pages, creating a loophole for remote attackers.

Mitigation and Prevention

Protecting systems from CVE-2017-5118 is crucial to maintaining security.

Immediate Steps to Take

Update Google Chrome to version 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android
Be cautious while browsing and avoid clicking on suspicious links

Long-Term Security Practices

Regularly update browsers and software to the latest versions
Implement strong content security policies to mitigate similar vulnerabilities

Patching and Updates

Ensure timely installation of security patches and updates to address known vulnerabilities.