CVE-2018-16073: Medium severity Google Chrome vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must get a user to interact with a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.

Q: Which systems can be confirmed vulnerable from the available version information?

Google Chrome versions earlier than 69.0.3497.81 are affected. Chromium-browser packages are listed for Red Hat and Debian, but the provided data does not specify the affected or fixed package versions for those distributions.

Q: How can I determine whether a Chrome installation needs remediation?

Check the installed Google Chrome version. Any version before 69.0.3497.81 should be treated as affected and updated to at least that version or a later supported release.

Published Sep 5, 2018

Updated

Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.

Other sources

The following flaw was identified in the Chromium browser: Site Isolation bypass after tab restore.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=863069

External References:

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

— Red Hat

Affected Software

3 affected componentsFixes available

redhat/chromium-browser<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 69.0.3497.81

Event History

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4289

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must get a user to interact with a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.

Which systems can be confirmed vulnerable from the available version information?

Google Chrome versions earlier than 69.0.3497.81 are affected. Chromium-browser packages are listed for Red Hat and Debian, but the provided data does not specify the affected or fixed package versions for those distributions.

How can I determine whether a Chrome installation needs remediation?

Check the installed Google Chrome version. Any version before 69.0.3497.81 should be treated as affected and updated to at least that version or a later supported release.

CVE-2018-16073: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which systems can be confirmed vulnerable from the available version information?

How can I determine whether a Chrome installation needs remediation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which systems can be confirmed vulnerable from the available version information?

How can I determine whether a Chrome installation needs remediation?