← back
CVE-2017-5124

CVE-2017-5124

EPSS 5.2%
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.
Affected products
n/a · Google Chrome prior to 62.0.3202.62
public PoCs found — 2
githubgithub.com/Bo0oM/CVE-2017-5124★ 160exploitdbwww.exploit-db.com/exploits/45867unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://access.redhat.com/errata/RHSA-2017:2997https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.htmlhttps://chromium.googlesource.com/chromium/src/+/4558c2885e618557a674660aff57404d25537070https://crbug.com/762930https://github.com/Bo0oM/CVE-2017-5124https://security.gentoo.org/glsa/201710-24https://www.debian.org/security/2017/dsa-4020https://www.reddit.com/r/netsec/comments/7cus2h/chrome_61_uxss_exploit_cve20175124/http://www.securityfocus.com/bid/101482