CVE-2018-16087: Medium severity Google Chrome vulnerability

Q: Which systems are affected?

Google Chrome versions prior to 69.0.3497.81 are affected. The affected software list also includes Red Hat and Debian Chromium Browser packages, but no package-specific fixed versions are provided.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by providing a crafted HTML page. The CVSS vector indicates that user interaction is required and that no privileges are required.

Q: What is the security impact?

Successful exploitation can bypass navigation restrictions, including multiple download restrictions. The reported CVSS impact is limited confidentiality impact, with no integrity or availability impact.

Q: How can I determine whether Chrome is vulnerable?

Check the installed Google Chrome version. Versions earlier than 69.0.3497.81 are affected; the provided data does not specify how to identify affected Chromium package builds.

Published Sep 4, 2018

Updated

Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Other sources

The following flaw was identified in the Chromium browser: Multiple download restriction bypass.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=848535

External References:

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

— Red Hat

Affected Software

4 affected componentsFixes available

redhat/chromium-browser<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

69.0.3497.81

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 69.0.3497.81
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 69.0.3497.81

Event History

Sep 4, 2018

CVE Published

12:00 AM

Jan 9, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which systems are affected?

Google Chrome versions prior to 69.0.3497.81 are affected. The affected software list also includes Red Hat and Debian Chromium Browser packages, but no package-specific fixed versions are provided.

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by providing a crafted HTML page. The CVSS vector indicates that user interaction is required and that no privileges are required.

What is the security impact?

Successful exploitation can bypass navigation restrictions, including multiple download restrictions. The reported CVSS impact is limited confidentiality impact, with no integrity or availability impact.

How can I determine whether Chrome is vulnerable?

Check the installed Google Chrome version. Versions earlier than 69.0.3497.81 are affected; the provided data does not specify how to identify affected Chromium package builds.

CVE-2018-16087: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

What is the security impact?

How can I determine whether Chrome is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

What is the security impact?

How can I determine whether Chrome is vulnerable?