CVE-2019-5865: Medium severity Google Chrome vulnerability
Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need in order to exploit this issue?
The attacker must first compromise the Chrome renderer process, then use a crafted HTML page to bypass site isolation. User interaction is required under the supplied CVSS vector.
Which versions are affected?
Google Chrome versions prior to 76.0.3809.87 are affected. The listed software also includes Debian's chromium package, but no affected Debian package version is provided.
What security boundary can be bypassed?
A successful exploit bypasses Chrome site isolation because navigation policy enforcement is insufficient. The supplied CVSS vector rates the impact as high integrity impact, with no confidentiality or availability impact.