CVE-2019-5848: Medium severity Google Chrome vulnerability
Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get a user to interact with a crafted HTML page. The CVSS vector indicates the attack is network-reachable, requires no privileges, and requires user interaction.
What information could be exposed?
The issue could allow disclosure of potentially sensitive information from process memory. The CVSS vector rates confidentiality impact as high, with no stated integrity or availability impact.
Which Chrome versions are affected?
Google Chrome versions prior to 75.0.3770.142 are affected. The supplied software list also includes Debian's chromium package, but does not provide its fixed package version.