CVE-2019-5856: Input Validation
Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What must an attacker achieve before this issue can be exploited?
The attacker must first compromise the Chrome renderer process. Exploitation then involves a crafted HTML page to bypass site isolation.
Which deployments are known to be affected?
Google Chrome versions prior to 76.0.3809.87 are affected. The listed software also includes Debian Chromium, but no affected Debian package version is provided.
Does the available information show that a default Chrome configuration is affected?
No. The data identifies insufficient storage policy enforcement and a site-isolation bypass after renderer compromise, but it does not state whether default configurations are affected or whether site isolation must be enabled.