CVE-2019-5859: High severity Google Chrome vulnerability
Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 76.0.3809.87
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which systems are affected?
The issue affects Google Chrome on Windows before version 76.0.3809.87. The provided data also lists Debian's chromium package, but does not specify affected package versions or platforms.
What does exploitation require?
An attacker can be remote and does not need prior privileges, but a user must interact with a crafted HTML page. Exploitation relies on insufficient filtering of URI schemes to bypass navigation restrictions.
Is immediate patching necessary?
Update Chrome on Windows to version 76.0.3809.87 or later. The supplied data does not provide a workaround or mitigation for systems that cannot be updated immediately.