Insufficient Policy Enforcement in Google Chrome Affecting Multiple Platforms

CVE-2017-5046

Summary

The vulnerability in Google Chrome stems from inadequate enforcement of security policies within the V8 engine, which can be exploited by remote attackers. By crafting a malicious HTML page, an attacker is able to spoof the location object. This exploitation can lead to unintended information disclosure through the Blink rendering engine, potentially compromising user sessions or privacy. The affected versions are prior to 57.0.2987.98 for Mac, Windows, and Linux and prior to 57.0.2987.108 for Android.

References