CVE-2019-18893: XSS
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this XSS vulnerability?
The vulnerability ID for this XSS vulnerability is CVE-2019-18893.
What is the severity level of CVE-2019-18893?
The severity level of CVE-2019-18893 is medium.
Which software versions are affected by CVE-2019-18893?
The Avast Secure Browser versions 77.1.1831.91 and AVG Secure Browser version 77.0.1790.77 are affected by CVE-2019-18893.
What does CVE-2019-18893 allow websites to do?
CVE-2019-18893 allows websites to execute their code in the context of the Video Downloader component.
Where can I find more information about CVE-2019-18893?
You can find more information about CVE-2019-18893 at the following link: https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/