CVE-2019-5864: Insufficient port filtering in CORS for extensions
Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 76.0.3809.87
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must convince a user to install a malicious Chrome extension. Exploitation also requires user interaction, as reflected in the CVSS vector.
What security impact can exploitation have?
A malicious extension can bypass content security policy using a crafted Chrome Extension. The stated impact is integrity-only; confidentiality and availability impacts are not indicated.
Which versions should be remediated?
Google Chrome versions prior to 76.0.3809.87 are affected. The listed software also includes Debian Chromium, with a Debian security advisory reference provided.