PatchSiren cyber security CVE debrief

CVE-2017-5021 Google CVE debrief

CVE-2017-5021 is a Google Chrome vulnerability described by NVD as a use-after-free that could be triggered by a crafted HTML page and result in an out-of-bounds memory read. The record assigns CVSS 4.3 (medium) with network attackability, no privileges required, and user interaction required, so it is best treated as a routine but important browser patching item.

Vendor: Google
Product: CVE-2017-5021
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2017-02-17
Original CVE updated: 2026-05-13
Advisory published: 2017-02-17
Advisory updated: 2026-05-13

Who should care

Organizations that manage Google Chrome on Linux, Windows, macOS, or Android; endpoint security teams; browser fleet owners; and IT teams responsible for rapid browser updates.

Technical summary

The supplied NVD record identifies CWE-416 (use after free) in Google Chrome. The vulnerable range is listed as Chrome versions up to 55.0.2883.87, with fixes noted in the record for desktop builds before 56.0.2924.76 and Android builds before 56.0.2924.87. The reported impact is an out-of-bounds memory read reachable through a crafted HTML page.

Defensive priority

Medium priority. The vulnerability is remotely reachable but requires user interaction, and the supplied CVSS vector indicates limited impact. It should still be patched promptly as part of standard browser vulnerability management.

Recommended defensive actions

Update Google Chrome to a fixed release at or above 56.0.2924.76 on Linux, Windows, and macOS, and at or above 56.0.2924.87 on Android.
Verify fleet versions after patching, including managed desktop and mobile browser deployments.
Use approved vendor or OS package channels to roll out browser updates and confirm that pinned or delayed-update systems are brought up to date.
Prioritize users and systems that routinely browse untrusted web content, since the trigger is a crafted HTML page.
Track browser security advisories and related distribution advisories referenced in the source metadata for deployment confirmation.

Evidence notes

This debrief is based on the supplied NVD CVE metadata and its listed references. The record provides the vulnerability class (CWE-416), the CVSS vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), the affected Chrome version boundary, and the description of a crafted-HTML-page trigger. The source metadata also lists a Chromium bug link, Google Chrome release blog entry, and distribution advisories as references; no additional facts are asserted beyond the supplied corpus.

Official resources

Publicly disclosed on 2017-02-17 07:59:00.667Z. The supplied record was later modified on 2026-05-13 00:24:29.033Z. No KEV entry was supplied.