Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux Windows and Mac and 58.0.3029.83 for Android allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.