CVE-2019-5861: Medium severity Google Chrome vulnerability
Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get a user to interact with a crafted HTML page. The CVSS vector indicates the attack can be delivered over the network without authentication, but requires user interaction.
Which versions are affected?
Google Chrome versions prior to 76.0.3809.87 are affected. The provided software list also identifies Debian Chromium, but does not specify affected or fixed package versions.
What is the practical impact of successful exploitation?
Successful exploitation allows bypass of an anti-clickjacking policy. The supplied CVSS metrics rate integrity impact as low and report no confidentiality or availability impact.