CVE-2019-5862: Input Validation
Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to compromise the Chrome renderer process and use a crafted HTML page. User interaction is also required according to the CVSS vector.
Are users of current Chrome versions affected?
The issue affects Google Chrome versions before 76.0.3809.87. Updating to 76.0.3809.87 or later addresses the affected version range described here.
What security boundary can be bypassed?
A successful exploit can bypass Chrome site isolation after the renderer process has been compromised. The reported impact is integrity-only; confidentiality and availability impacts are not listed in the CVSS vector.