CVE-2018-16078: Infoleak
A credit card information leak flaw was found in the Autofill component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=858820
External References:
https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html
Other sources
Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 69.0.3497.81 - Upgrade
Upgrade
Google Chrome/Chromiumto a version that resolves this vulnerability.Fixed in 69.0.3497.81
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16078?
CVE-2018-16078 has been rated as a high severity vulnerability due to the potential leak of sensitive credit card information.
How do I fix CVE-2018-16078?
To fix CVE-2018-16078, update Google Chrome or Chromium to version 69.0.3497.81 or later.
What type of vulnerability is CVE-2018-16078?
CVE-2018-16078 is a credit card information leak vulnerability in the Autofill component of Google Chrome.
Can CVE-2018-16078 be exploited remotely?
Yes, CVE-2018-16078 can be exploited remotely via a crafted HTML page.
Which versions of Chrome are affected by CVE-2018-16078?
CVE-2018-16078 affects versions of Google Chrome prior to 69.0.3497.81.