CVE-2019-13739: Medium severity Google Chrome vulnerability

Q: What is the severity of CVE-2019-13739?

The severity of CVE-2019-13739 is medium with a severity score of 6.5.

Q: How does CVE-2019-13739 exploit work?

CVE-2019-13739 exploits an insufficient policy enforcement in the Omnibox in Google Chrome prior to version 79.0.3945.79 that allows a remote attacker to perform domain spoofing via IDN homographs using a crafted domain name.

Q: Which software versions are affected by CVE-2019-13739?

Google Chrome prior to version 79.0.3945.79, Chromium prior to version 90.0.4430.212-1 (Debian 10), and Chromium prior to version 116.0.5845.180-1 (Debian 11 and 12) are affected by CVE-2019-13739.

Q: How can I fix CVE-2019-13739?

To fix CVE-2019-13739, users should update their Google Chrome or Chromium browser to version 79.0.3945.79 or higher.

Q: Where can I find more information about CVE-2019-13739?

You can find more information about CVE-2019-13739 on the Debian Security Tracker, Chromium issue tracker, and the Google Chrome Releases blog.

Published Dec 10, 2019

Updated

An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=824715

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

Other sources

Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

Affected Software

15 affected componentsFixes available

redhat/chromium-browser<79.0.3945.79

79.0.3945.79

Google Chrome<79.0.3945.79

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=30

Fedoraproject Fedora=31

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux For Scientific Computing=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 79.0.3945.79
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome/Chromium to a version that resolves this vulnerability.
Fixed in 79.0.3945.79

Event History

Dec 10, 2019

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4606

Frequently Asked Questions

What is the severity of CVE-2019-13739?