CVE-2018-20067: Medium severity Google Chrome vulnerability

Q: What is the severity of CVE-2018-20067?

CVE-2018-20067 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2018-20067?

To fix CVE-2018-20067, update Google Chrome to version 71.0.3578.80 or later.

Q: What impact does CVE-2018-20067 have on users?

CVE-2018-20067 can confuse users regarding the origin of the current page, potentially leading to phishing attacks.

Q: Who is affected by CVE-2018-20067?

CVE-2018-20067 affects users of Google Chrome versions prior to 71.0.3578.80.

Q: Can CVE-2018-20067 be exploited remotely?

Yes, CVE-2018-20067 can be exploited remotely through a crafted HTML page.

Published Jan 9, 2019

Updated

A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.

Affected Software

2 affected componentsFixes available

Google Chrome<71.0.3578.80

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Jan 9, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4352

Frequently Asked Questions

What is the severity of CVE-2018-20067?

CVE-2018-20067 is classified as a medium severity vulnerability.

How do I fix CVE-2018-20067?