PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5019 Google CVE debrief

CVE-2017-5019 is a Chrome use-after-free vulnerability that could let a remote attacker trigger heap corruption by getting a victim to load a crafted HTML page. NVD rates it medium severity, with network attack vector and required user interaction. Google’s advisory links show it was addressed in Chrome 56.0.2924.76 for Linux, Windows, and Mac, and 56.0.2924.87 for Android.

Vendor
Google
Product
CVE-2017-5019
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Security teams managing Google Chrome on desktops or Android devices, especially environments where users browse untrusted web content. Endpoint defenders and patch management teams should prioritize updating affected Chrome installations.

Technical summary

NVD classifies the flaw as CWE-416 (use after free) in Google Chrome. The reported impact is potential heap corruption reachable remotely through a crafted HTML page. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) indicates a low-complexity network attack that still depends on user interaction.

Defensive priority

Medium-high. The vulnerability is remotely reachable through web content and affects a widely deployed browser, but exploitation requires user interaction. Patch affected Chrome versions promptly, especially on systems exposed to regular web browsing.

Recommended defensive actions

  • Update Google Chrome to 56.0.2924.76 or later on Linux, Windows, and Mac, or 56.0.2924.87 or later on Android.
  • Verify endpoint and mobile device compliance to confirm no affected Chrome versions remain installed.
  • Treat untrusted web content as a potential delivery path and reinforce browser update enforcement in managed environments.
  • Use vendor advisories and distro security notices referenced by NVD to confirm platform-specific remediation guidance.

Evidence notes

This debrief is based on the supplied NVD record and its referenced official/vendor links. The CVE was published on 2017-02-17. NVD describes the issue as a Chrome use-after-free (CWE-416) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The supplied description states the affected fixed versions: before 56.0.2924.76 on Linux, Windows, and Mac, and before 56.0.2924.87 on Android. Reference links listed in NVD include the Chrome release advisory, Chrome bug tracker entry, and distro/security notices.

Official resources

Publicly disclosed in 2017-02-17 NVD/CVE records and referenced by Google Chrome release and downstream vendor advisories.