CVE-2020-6396: Medium severity Google Chrome vulnerability
An inappropriate implementation flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1035271
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
Other sources
Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1 - Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 80.0.3987.87 - Upgrade
Upgrade
chromium/google chrome (Skia component)to a version that resolves this vulnerability.Fixed in 80.0.3987.87Patch 1035271 - Compensating control
Until updated, mitigate the Omnibox spoofing by limiting users to trusted browsing sources and using browser security protections that reduce exposure to malicious pages.
Event History
Frequently Asked Questions
What is CVE-2020-6396?
CVE-2020-6396 is a vulnerability in Skia in Google Chrome prior to version 80.0.3987.87 that allowed a remote attacker to spoof the contents of the URL bar.
How severe is CVE-2020-6396?
CVE-2020-6396 has a severity rating of 4.3, which is considered medium.
How can I fix CVE-2020-6396?
To fix CVE-2020-6396, update your Google Chrome browser to version 80.0.3987.87 or later.
What software is affected by CVE-2020-6396?
The affected software includes Google Chrome prior to version 80.0.3987.87, Chromium on Debian, chromium-browser on Red Hat, and various other software versions on different operating systems. Please refer to the references for more details.
Where can I find more information about CVE-2020-6396?
You can find more information about CVE-2020-6396 at the following references: [Link 1](https://security-tracker.debian.org/tracker/CVE-2020-6396), [Link 2](https://code.google.com/p/chromium/issues/detail?id=1035271), [Link 3](https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html)