CVE-2020-6403: Medium severity Google Chrome vulnerability
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1006012
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
Other sources
Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1 - Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 80.0.3987.87 - Upgrade
Upgrade
chromium/omniboxto a version that resolves this vulnerability.Fixed in 80.0.3987.87 - Compensating control
Because the issue is in Omnibox/URL bar UI spoofing in Google Chrome on iOS prior to 80.0.3987.87, ensure users treat Omnibox contents cautiously when visiting untrusted pages until updated.
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-6403.
What is the severity level of CVE-2020-6403?
The severity level of CVE-2020-6403 is medium.
What is the affected software of CVE-2020-6403?
The affected software of CVE-2020-6403 includes Google Chrome on iOS prior to version 80.0.3987.87, Chromium Browser on Redhat, and Chromium on Debian.
How can a remote attacker exploit CVE-2020-6403?
A remote attacker can exploit CVE-2020-6403 by spoofing the contents of the Omnibox (URL bar) in Google Chrome on iOS through a crafted HTML page.
Where can I find more information about CVE-2020-6403?
You can find more information about CVE-2020-6403 at the following references: [link1](https://security-tracker.debian.org/tracker/CVE-2020-6403), [link2](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html), and [link3](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html).