CVE-2017-5033

CVE-2017-5033 describes a vulnerability in Google Chrome (prior to versions 57.0.2987.98 for desktop and 57.0.2987.108 for Android) where the Blink rendering engine failed to properly enforce Content Security Policy (CSP) restrictions on local scheme pages. This allowed a remote attacker to bypass CSP via a specially crafted HTML page, particularly when the "unsafe-inline" keyword was present. Rated as Medium severity (CVSS 4.3), this vulnerability requires user interaction (UI:R) and could lead to low impact on integrity (I:L) with no confidentiality or availability impact. While it affected products from Google, Apple, Microsoft, and Linux distributions, there is no evidence of active exploitation, nor are there public exploits available in Metasploit or ExploitDB, despite some community discussion and media coverage at the time of discovery.