CVE-2018-16084: XSS
An user confirmation bypass flaw was found in the external protocol handling component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=865202
External References:
https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html
Other sources
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 69.0.3497.81 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 69.0.3497.81
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16084?
CVE-2018-16084 has been classified as a medium severity vulnerability due to the potential for a user confirmation bypass.
How do I fix CVE-2018-16084?
To fix CVE-2018-16084, upgrade to Google Chrome version 69.0.3497.81 or later.
Who is affected by CVE-2018-16084?
Users of Google Chrome versions prior to 69.0.3497.81 are affected by CVE-2018-16084.
What kind of attack can exploit CVE-2018-16084?
CVE-2018-16084 can be exploited by a remote attacker to open external programs through a crafted HTML page.
What software versions are impacted by CVE-2018-16084?
CVE-2018-16084 impacts Google Chrome versions prior to 69.0.3497.81 and certain Red Hat Linux distributions.