CVE-2017-5011

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 56.0.2924.76 Opera versions prior to 56.0.2924.76

Description The issue is related to insufficient sanitization of DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. This could be achieved by exploiting the lack of protection for service data.

Recommendations For Google Chrome versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later. For Opera versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later. As a temporary workaround, consider disabling the installation of extensions until a patch is available. Restrict access to the DevTools module to minimize the risk of exploitation. Avoid using crafted HTML pages in the affected browser versions until the issue is resolved.