PatchSiren cyber security CVE debrief
CVE-2017-5026 Google CVE debrief
CVE-2017-5026 is a Google Chrome UI-layer flaw where swapped-out frames could still display alerts, allowing a remote attacker to present misleading alerts from a crafted page. The issue was published on 2017-02-17, and the source corpus points to a fixed Chrome release in the 56.0.2924.76 line.
- Vendor
- Product
- CVE-2017-5026
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-17
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-17
- Advisory updated
- 2026-05-13
Who should care
Organizations running Google Chrome on desktops, especially endpoint teams and browser administrators managing managed fleets or user-installed browsers. Security teams should pay attention because the impact is UI spoofing rather than code execution, but it can still be used to mislead users.
Technical summary
NVD classifies the weakness as CWE-1021 and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. In practical terms, Chrome failed to prevent alerts from being displayed by swapped-out frames, so a remote site could show an alert on a page it does not control. The issue affected Chrome for Linux, Windows, and Mac before the fixed release referenced in the advisory.
Defensive priority
Medium. The flaw requires user interaction and is limited to integrity impact, but it affects a widely deployed browser and can be used for deceptive UI behavior.
Recommended defensive actions
- Upgrade Google Chrome to a fixed release at or above the version referenced in the advisory.
- Verify managed browser fleets are on a current supported Chrome channel and enforce rapid update rollout.
- Treat unexpected browser alerts or dialogs as untrusted unless they originate from a verified application or managed extension.
- Check endpoint baselines for obsolete Chrome versions and remove local update blockers.
- If your security controls depend on browser prompts, validate them against current Chrome behavior after patching.
Evidence notes
The CVE description says Chrome prior to 56.0.2924.76 for Linux, Windows, and Mac allowed alerts from swapped-out frames on pages the attacker did not control. NVD maps the weakness to CWE-1021 and lists CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The source references include Google’s stable-channel release note, the Chromium bug entry, and downstream advisories from Debian, Red Hat, and Gentoo.
Official resources
Publicly disclosed on 2017-02-17. The NVD source item retains the same publication date, while the record was later modified on 2026-05-13; that later date reflects database maintenance, not the original vulnerability disclosure.