Skip to content
CVE Tracker
Back

CVE-2017-5033

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP…

Medium4.3EPSS 1.7%
Published
Updated
Reserved
Assigned by
Chrome

Description

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.

Scores

CVSS scores of CVE-2017-5033, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS (exploitation in 30 days)
1.7% · top 22% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

Affected products

  • Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android

    • affected Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android

References (7)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .