CVE-2018-16086: Medium severity Google Chrome vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must convince a user to install a malicious Chrome extension. Exploitation then uses a crafted extension to bypass navigation restrictions through insufficient extensions API policy enforcement.

Q: Are users exposed without installing an extension?

The described attack requires user interaction to install a malicious extension. The provided CVSS vector also identifies user interaction as required.

Q: Which versions are affected?

Google Chrome versions prior to 69.0.3497.81 are affected. The listed software also includes Chromium browser packages from Red Hat and Debian, but no package-specific affected version ranges are provided.

Published Sep 7, 2018

Updated

A script injection flaw was found in the New Tab Page component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=844428

External References:

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

Other sources

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

— MITRE

Affected Software

3 affected componentsFixes available

redhat/chromium-browser<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 69.0.3497.81

Event History

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4289

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must convince a user to install a malicious Chrome extension. Exploitation then uses a crafted extension to bypass navigation restrictions through insufficient extensions API policy enforcement.

Are users exposed without installing an extension?

The described attack requires user interaction to install a malicious extension. The provided CVSS vector also identifies user interaction as required.

Which versions are affected?

Google Chrome versions prior to 69.0.3497.81 are affected. The listed software also includes Chromium browser packages from Red Hat and Debian, but no package-specific affected version ranges are provided.

CVE-2018-16086: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are users exposed without installing an extension?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are users exposed without installing an extension?

Which versions are affected?