CVE-2019-5822: CORS bypass in download manager
Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 74.0.3729.108 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2019-5822.
What is the severity of CVE-2019-5822?
The severity of CVE-2019-5822 is high (8.8).
How does this vulnerability affect Google Chrome?
This vulnerability affects Google Chrome versions prior to 74.0.3729.108.
How can a remote attacker exploit this vulnerability?
A remote attacker can exploit this vulnerability by bypassing the same origin policy via a crafted HTML page.
Is there a fix available for CVE-2019-5822?
Yes, a fix is available. Users should update to Google Chrome version 74.0.3729.108 or higher.