CVE-2018-6145: XSS

Q: What user interaction is required for exploitation?

An attacker must entice a user to load a crafted HTML page. No prior privileges are required, and the attack can be delivered remotely.

Q: What is the security impact if exploitation succeeds?

A successful attack can bypass the browser's same-origin policy, allowing limited disclosure or modification of data across origins. The provided vector does not indicate an availability impact.

Q: Which Chrome versions are known to be affected?

Google Chrome versions earlier than 67.0.3396.62 are affected. The listed Chromium browser packages for Debian and Red Hat are also associated with this issue, but no package-specific fixed versions are provided.

Published May 30, 2018

Updated

An incorrect escaping of mathml flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=805924

External References:

https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop58.html

Other sources

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Affected Software

3 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<67.0.3396.62

67.0.3396.62

Google Chrome<67.0.3396.62

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 67.0.3396.62
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 67.0.3396.62

Event History

May 30, 2018

Data Sourced

via Red Hat·07:58 AM

DescriptionSeverityAffected Software

Jun 27, 2019

CVE Published

via MITRE·04:13 PM

Data Sourced

via MITRE·04:13 PM

DescriptionWeakness

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must entice a user to load a crafted HTML page. No prior privileges are required, and the attack can be delivered remotely.

What is the security impact if exploitation succeeds?

A successful attack can bypass the browser's same-origin policy, allowing limited disclosure or modification of data across origins. The provided vector does not indicate an availability impact.

Which Chrome versions are known to be affected?

Google Chrome versions earlier than 67.0.3396.62 are affected. The listed Chromium browser packages for Debian and Red Hat are also associated with this issue, but no package-specific fixed versions are provided.

CVE-2018-6145: XSS

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

What is the security impact if exploitation succeeds?

Which Chrome versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

What is the security impact if exploitation succeeds?

Which Chrome versions are known to be affected?