CVE-2017-5078

CVE-2017-5078 describes an insufficient input validation vulnerability in Google Chrome's Blink engine, specifically affecting mailto: handling in versions prior to 59.0.3071.86 on Linux, Windows, and Mac. This flaw allows a remote attacker to achieve command injection through a specially crafted HTML page, similar to CVE-2004-0121, by exploiting how characters like asterisks and spaces interact with xdg-email. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable over the network with low attack complexity, requiring user interaction, and could lead to high impacts on confidentiality, integrity, and availability. While it has a high FAUCET Risk Score and some community discussion, there is no evidence of active exploitation, nor are there public exploits available in Metasploit, Nuclei, or ExploitDB.