CVE-2019-5858: Input Validation
Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which systems are affected?
The issue affects Google Chrome on OS X before version 76.0.3809.87. The provided data also lists debian/chromium, but does not identify affected Debian versions or configurations.
What does an attacker need to exploit this vulnerability?
An attacker needs to get a user to interact with a crafted HTML page. The CVSS vector indicates the attack can be delivered over the network, requires no attacker privileges, and has low attack complexity; the description identifies the attacker as local.
What is the potential impact of successful exploitation?
Successful exploitation can allow arbitrary code execution. The CVSS assessment indicates high impact to confidentiality, integrity, and availability.