CVE-2020-6403: Medium severity Google Chrome vulnerability
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1006012
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
Other sources
Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 80.0.3987.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
chromium/omniboxto a version that resolves this vulnerability.Fixed in 80.0.3987.87 - Compensating control
Because the issue is in Omnibox/URL bar UI spoofing in Google Chrome on iOS prior to 80.0.3987.87, ensure users treat Omnibox contents cautiously when visiting untrusted pages until updated.
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-6403.
What is the severity level of CVE-2020-6403?
The severity level of CVE-2020-6403 is medium.
What is the affected software of CVE-2020-6403?
The affected software of CVE-2020-6403 includes Google Chrome on iOS prior to version 80.0.3987.87, Chromium Browser on Redhat, and Chromium on Debian.
How can a remote attacker exploit CVE-2020-6403?
A remote attacker can exploit CVE-2020-6403 by spoofing the contents of the Omnibox (URL bar) in Google Chrome on iOS through a crafted HTML page.
Where can I find more information about CVE-2020-6403?
You can find more information about CVE-2020-6403 at the following references: [link1](https://security-tracker.debian.org/tracker/CVE-2020-6403), [link2](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html), and [link3](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html).