CVE-2017-5006

What it actually does

Incorrect handling of object owner relationships in the Blink rendering engine permits universal cross-site scripting, allowing injection of arbitrary scripts or HTML that execute in the context of any origin.

Why it matters to the business

Attackers can steal session data, perform actions on behalf of users, or deface content in any web application visited through the vulnerable browser, leading to account compromise and loss of trust.

How an attack unfolds

An attacker crafts a malicious HTML page that triggers the flawed object owner logic when rendered; when a victim visits the page, the injected script runs with elevated privileges across origins, enabling data theft or further attacks.

How to fix it

Upgrade Google Chrome to version 56.0.2924.76 or later on Linux, Windows, and Mac, or 56.0.2924.87 or later on Android. Apply updates through the built-in updater or official distribution channels.

How to confirm the fix worked

Confirm Chrome reports a version at or above the fixed releases; test with a crafted HTML page that previously triggered UXSS to verify the injection no longer succeeds.

Typical attack path

1. Craft a malicious HTML document exploiting object owner mishandling
2. Host the page on an attacker-controlled domain or deliver via phishing
3. Lure the victim to visit the page in an affected Chrome version
4. Execute injected script to bypass same-origin policy and access other origins

How to detect it

Review browser version history and update logs for instances remaining below the fixed releases; examine web proxy or endpoint logs for access to known malicious pages that target this rendering issue.

What your security team should do

• Prioritize browser updates across all managed endpoints
• Enforce automatic updates via enterprise policies
• Monitor for users on versions older than the fixed releases