CVE-2020-15973: Insufficient policy enforcement in extensions

Reference Links

• https://security-tracker.debian.org/tracker/CVE-2020-15973
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
• https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html (Advisory)
• https://crbug.com/1106890
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
• https://www.debian.org/security/2021/dsa-4824
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/

Parent vulnerabilities

(Appears in the following advisories)

• 7211503174014671839

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2020-15967
• CVE-2020-15968
• CVE-2020-15969
• CVE-2020-15970
• CVE-2020-15971
• CVE-2020-15972
• CVE-2020-15990
• CVE-2020-15991
• CVE-2020-15974
• CVE-2020-15975
• CVE-2020-15976
• CVE-2020-6557
• CVE-2020-15977
• CVE-2020-15978
• CVE-2020-15979
• CVE-2020-15980
• CVE-2020-15981
• CVE-2020-15982
• CVE-2020-15983
• CVE-2020-15984
• CVE-2020-15985
• CVE-2020-15986
• CVE-2020-15987
• CVE-2020-15992
• CVE-2020-15988
• CVE-2020-15989

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID for this issue is CVE-2020-15973.

• What is the title of the vulnerability?

  The title of the vulnerability is 'Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker to bypass same origin policy via a crafted Chrome Extension'.

• What is the severity of CVE-2020-15973?

  The severity of CVE-2020-15973 is medium with a severity score of 6.5.

• Which software versions are affected by this vulnerability?

  Google Chrome versions prior to 86.0.4240.75, Fedora 31, Fedora 32, Fedora 33, openSUSE Backports SLE 15.0-sp2, Debian Debian Linux 10.0, and Chromium versions 90.0.4430.212-1~deb10u1, 116.0.5845.180-1~deb11u1, 118.0.5993.117-1~deb11u1, 116.0.5845.180-1~deb12u1, 118.0.5993.117-1~deb12u1, 118.0.5993.117-1, and 119.0.6045.105-1 are affected.

• How can an attacker exploit this vulnerability?

  An attacker can exploit this vulnerability by convincing a user to install a malicious extension, which allows them to bypass the same origin policy via a crafted Chrome Extension.