PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5019 Google CVE debrief

CVE-2017-5019 is a Chrome use-after-free vulnerability that could let a remote attacker trigger heap corruption by getting a victim to load a crafted HTML page. NVD rates it medium severity, with network attack vector and required user interaction. Google’s advisory links show it was addressed in Chrome 56.0.2924.76 for Linux, Windows, and Mac, and 56.0.2924.87 for Android.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-17
Original CVE updated
2026-05-13
Advisory published
2017-02-17
Advisory updated
2026-05-13

Who should care

Security teams managing Google Chrome on desktops or Android devices, especially environments where users browse untrusted web content. Endpoint defenders and patch management teams should prioritize updating affected Chrome installations.

Technical summary

NVD classifies the flaw as CWE-416 (use after free) in Google Chrome. The reported impact is potential heap corruption reachable remotely through a crafted HTML page. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) indicates a low-complexity network attack that still depends on user interaction.

Defensive priority

Medium-high. The vulnerability is remotely reachable through web content and affects a widely deployed browser, but exploitation requires user interaction. Patch affected Chrome versions promptly, especially on systems exposed to regular web browsing.

Recommended defensive actions

  • Update Google Chrome to 56.0.2924.76 or later on Linux, Windows, and Mac, or 56.0.2924.87 or later on Android.
  • Verify endpoint and mobile device compliance to confirm no affected Chrome versions remain installed.
  • Treat untrusted web content as a potential delivery path and reinforce browser update enforcement in managed environments.
  • Use vendor advisories and distro security notices referenced by NVD to confirm platform-specific remediation guidance.

Evidence notes

This debrief is based on the supplied NVD record and its referenced official/vendor links. The CVE was published on 2017-02-17. NVD describes the issue as a Chrome use-after-free (CWE-416) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The supplied description states the affected fixed versions: before 56.0.2924.76 on Linux, Windows, and Mac, and before 56.0.2924.87 on Android. Reference links listed in NVD include the Chrome release advisory, Chrome bug tracker entry, and distro/security notices.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5019 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5019

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5019 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5019

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.