CVE-2018-16077: Medium severity Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

An attacker can exploit it remotely by getting a user to open a crafted HTML page. No attacker privileges are required, but user interaction is required.

Q: Who is most exposed?

Users of affected Chromium-based browser software are exposed when they browse attacker-controlled or otherwise crafted HTML content. The listed affected software includes Google Chrome and Chromium browser packages from Red Hat and Debian.

Q: What is the expected security impact?

Successful exploitation bypasses the browser's content security policy. The supplied CVSS vector indicates no confidentiality or availability impact, but a high integrity impact.

Q: How can I determine whether Google Chrome is affected?

Google Chrome versions earlier than 69.0.3497.81 are affected according to the available data. The data does not provide corresponding fixed package versions for the Red Hat or Debian Chromium browser packages.

Published Sep 5, 2018

Updated

A content security policy bypass flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=377995

External References:

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

Other sources

Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page.

— MITRE

Affected Software

3 affected componentsFixes available

redhat/chromium-browser<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome/Chromium to a version that resolves this vulnerability.
Fixed in 69.0.3497.81

Event History

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4289

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit it remotely by getting a user to open a crafted HTML page. No attacker privileges are required, but user interaction is required.

Who is most exposed?

Users of affected Chromium-based browser software are exposed when they browse attacker-controlled or otherwise crafted HTML content. The listed affected software includes Google Chrome and Chromium browser packages from Red Hat and Debian.

What is the expected security impact?

Successful exploitation bypasses the browser's content security policy. The supplied CVSS vector indicates no confidentiality or availability impact, but a high integrity impact.

How can I determine whether Google Chrome is affected?

Google Chrome versions earlier than 69.0.3497.81 are affected according to the available data. The data does not provide corresponding fixed package versions for the Red Hat or Debian Chromium browser packages.

CVE-2018-16077: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is most exposed?

What is the expected security impact?

How can I determine whether Google Chrome is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is most exposed?

What is the expected security impact?

How can I determine whether Google Chrome is affected?