CVE-2017-5008

CVE-2017-5008 is a Universal Cross-Site Scripting (UXSS) vulnerability affecting Google Chrome versions prior to 56.0.2924.76 on Linux, Windows, and Mac, and 56.0.2924.87 on Android. It allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page by exploiting a flaw in how attacker-controlled JavaScript could be run during the invocation of a private script method. With a CVSS score of 6.1 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring user interaction but potentially leading to low confidentiality and integrity impacts. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB, though it garnered significant community discussion and media coverage at the time.