Security readout for executives and security teams
Plain-English summary
CVE-2017-5027 is an old Google Chrome browser issue where a malicious web page could bypass a site's Content Security Policy protection. That protection helps limit script execution. The business risk is mainly for environments still running very old Chrome builds from before the 2017 fixes.
Executive priority
Prioritize as a legacy browser hygiene issue unless old Chrome remains in production. If legacy Chrome exists on internet-facing user workflows, remediation should be scheduled promptly because browser compromise paths can affect many business applications.
Technical view
Blink in Chrome before 56.0.2924.76 on Linux, Windows, and Mac, and before 56.0.2924.87 on Android, failed to properly enforce unsafe-inline Content Security Policy handling. A remote attacker could use a crafted HTML page to bypass CSP. The bundle provides no CVSS, CWE, patch detail beyond fixed Chrome versions, or exploit details.
Likely exposure
Exposure is likely limited to unmanaged, embedded, kiosk, legacy desktop, or Android environments still running Chrome versions older than the listed fixed releases. Current managed Chrome deployments should not be exposed if updates are enforced.
Exploitation context
The source bundle states remote attack via a crafted HTML page. It does not cite active exploitation, and KEV status is false. Treat exploitation evidence as incomplete rather than confirmed.
Researcher notes
Available evidence is sparse: NVD-style text identifies a CSP bypass in Blink and fixed Chrome versions. The referenced Chromium bug may contain additional detail, but the prompt bundle does not include exploitability notes, root-cause specifics, or regression-test information.
Mitigation direction
- Update Chrome to 56.0.2924.76 or later on Linux, Windows, and Mac.
- Update Android Chrome to 56.0.2924.87 or later.
- Check Google Chrome release guidance for vendor-confirmed remediation details.
- Remove or isolate legacy browsers that cannot be updated.
- Enforce managed browser update policies across desktop and mobile fleets.
Validation and detection
- Inventory Chrome versions across endpoints, kiosks, VDI images, and Android devices.
- Confirm all desktop Chrome versions are at least 56.0.2924.76.
- Confirm Android Chrome versions are at least 56.0.2924.87.
- Review browser management telemetry for unmanaged or stale devices.
- Document any unsupported systems requiring compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-5027 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.htmlCVE reference · x_refsource_CONFIRM
- https://crbug.com/661126CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.