CVE-2017-15397
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a...
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
- Record
CVE-2017-15397- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-311
- Updated
- 2026-11-02
CVE List No score
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
- Record
CVE-2017-15397- Updated
- 2026-11-02
EUVDEUVD-2017-6850 No score
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
- Record
EUVD-2017-6850- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fvmw-p7gf-4cq2
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a...
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
- Record
GHSA-fvmw-p7gf-4cq2- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-311
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15397 is a high vulnerability (CVSS 7.4) in Google Chrome Os, published February 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.
References
wwws.nightwatchcybersecurity.com/2018/01/01/chromeos-doesnt-always-use-ssl-during-startup-cve-2017-15397
securityfocus.com/bid/102435
chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
crbug.com/627300
nvd.nist.gov/vuln/detail/CVE-2017-15397
github.com/advisories/GHSA-fvmw-p7gf-4cq2