PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2017-5124] Lỗi nghiêm trọng trên trình duyệt nguồn mở Chromium

blog.viettelcybersecurity.com | vulnerability | CVE-2017-5124 | #browser-security | #xss | #chromium | #cve-2017-5124 | #uxss | #mhtml
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2017-5124 is a Universal Cross-site Scripting (UXSS) flaw in Chromium's MHTML handling affecting version 62 and below, letting attackers bypass browser security and read cookies across open tabs.
CVE
CVE-2017-5124
Published
Collected

Related coverage

blog · hacktron.ai
Securing Perplexity’s AI Browser from a One-Click UXSS
How Hacktron AI Research team identified and prevented a critical UXSS vulnerability in Perplexity's AI Browser - Comet.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · tenzai.com
From XSS to RCE: Two Exploit Chains in ConcreteCMS
We show how in 2026 chaining vulnerabilities is crucial for impact and how production environments differ from source code
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
Medium · vulnerability · pwn.ai
CVE-2026-14077: Select Your Own Origin - Spoofing Chrome's Address Bar
pwn.ai's CVE-2026-14077: an HTML select positioned partly above the viewport let a page draw native UI over Chrome's toolbar, spoofing the omnibox for a convincing fake download flow.
Back