CVE-2019-5814: CORS bypass in Blink

Reference Links

• https://security-tracker.debian.org/tracker/CVE-2019-5814
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html
• https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html (Advisory)
• https://crbug.com/930057
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/
• https://seclists.org/bugtraq/2019/Aug/19
• https://security.gentoo.org/glsa/201908-18
• https://www.debian.org/security/2019/dsa-4500
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/

Parent vulnerabilities

(Appears in the following advisories)

• 286281954613599470

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2019-5805
• CVE-2019-5806
• CVE-2019-5807
• CVE-2019-5808
• CVE-2019-5809
• CVE-2019-5810
• CVE-2019-5811
• CVE-2019-5812
• CVE-2019-5813
• CVE-2019-5815
• CVE-2019-5816
• CVE-2019-5817
• CVE-2019-5818
• CVE-2020-6503
• CVE-2019-5819
• CVE-2019-5820
• CVE-2019-5821
• CVE-2019-5822
• CVE-2019-5823
• CVE-2020-6504

Frequently Asked Questions

• What is CVE-2019-5814?

  CVE-2019-5814 is a vulnerability in Google Chrome that allows a remote attacker to leak cross-origin data via a crafted HTML page.

• How severe is CVE-2019-5814?

  CVE-2019-5814 has a severity rating of 6.5 out of 10, making it a medium severity vulnerability.

• Which software versions are affected by CVE-2019-5814?

  Google Chrome versions prior to 74.0.3729.108, openSUSE Backports for SLE-15, openSUSE Leap 15.0, openSUSE Leap 15.1, openSUSE Leap 42.3, Debian Debian Linux 10.0, Fedoraproject Fedora 29, Fedoraproject Fedora 30, and the Chromium package from Debian are affected by CVE-2019-5814.

• How can I fix CVE-2019-5814?

  To fix CVE-2019-5814, update your Google Chrome browser to version 74.0.3729.108 or later, or update the affected software package to the specified versions.

• Where can I find more information about CVE-2019-5814?

  You can find more information about CVE-2019-5814 at the following references: [1] http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html, [2] https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html, [3] https://crbug.com/930057.