CVE-2017-5028
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote...
CVE-2017-5028 is a medium vulnerability (CVSS 6.5) in Google Chrome, published January 31, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 3.0, NVD
- Exploit chance
- 0.91%EPSS, 60th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:8 From an advisory covering 23 CVEs | before 56.0.2924.76-1~deb8u1, plus listed versions 41.0.2272.118-142.0.2311.135-142.0.2311.135-1~deb8u142.0.2311.135-242.0.2311.90-1 Show 45 moreShow less42.0.2311.90-1~deb8u142.0.2311.90-243.0.2357.124-143.0.2357.124-243.0.2357.124-343.0.2357.130-143.0.2357.65-143.0.2357.65-1~deb8u143.0.2357.81-144.0.2403.107-144.0.2403.107-244.0.2403.157-144.0.2403.89-144.0.2403.89-1~deb8u145.0.2454.101-145.0.2454.85-145.0.2454.85-1~deb8u146.0.2490.13-146.0.2490.71-146.0.2490.71-1~deb8u147.0.2526.111-147.0.2526.16-147.0.2526.73-147.0.2526.73-1~deb8u147.0.2526.80-147.0.2526.80-1~deb8u147.0.2526.80-247.0.2526.80-348.0.2564.116-148.0.2564.116-1~deb8u148.0.2564.23-148.0.2564.82-148.0.2564.82-1~deb8u148.0.2564.82-249.0.2623.108-149.0.2623.108-1~deb8u149.0.2623.108-249.0.2623.75-149.0.2623.75-1~deb8u149.0.2623.75-249.0.2623.87-149.0.2623.87-1~deb8u150.0.2661.75-150.0.2661.75-1~deb8u150.0.2661.75-2 | 56.0.2924.76-1~deb8u1 |
What each source reports
NVD Score used
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
CVE-2017-5028- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
CVE-2017-5028- Updated
- 2026-11-02
EUVDEUVD-2017-14138No score
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
EUVD-2017-14138- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f55p-fgfp-vxmw
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote...
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
GHSA-f55p-fgfp-vxmw- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5028
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- Record
UBUNTU-CVE-2017-5028- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 36 versions. The JSON record has them.