CVE-2020-6414: High severity Google Chrome vulnerability

Q: What is the severity of CVE-2020-6414?

CVE-2020-6414 has been classified as a high severity vulnerability due to inadequate policy enforcement in the Chromium browser's Safe Browsing component.

Q: How do I fix CVE-2020-6414?

To fix CVE-2020-6414, users should update their Chromium or Chrome browser to the latest patched version as specified in the security advisories.

Q: What versions of Chromium are affected by CVE-2020-6414?

CVE-2020-6414 affects specific versions of Chromium including versions prior to 90.0.4430.212 and 80.0.3987.87 for certain distributions.

Q: Is CVE-2020-6414 still exploitable?

CVE-2020-6414 may still be exploitable if users have not updated to the recommended patched versions of Chromium or Chrome.

Q: Which operating systems are impacted by CVE-2020-6414?

CVE-2020-6414 impacts multiple operating systems that run affected versions of the Chromium browser, including Debian, Red Hat, and openSUSE.

Published Feb 10, 2020

Updated

An insufficient policy enforcement flaw was found in the Safe Browsing component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1021855

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

Other sources

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Affected Software

4 affected componentsFixes available

debian/chromium

90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1

redhat/chromium-browser<80.0.3987.87

80.0.3987.87

Google Chrome<80.0.3987.87

openSUSE Backports=15.0-sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1
Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 80.0.3987.87
Upgrade
Upgrade chromium/google chrome safe browsing to a version that resolves this vulnerability.
Fixed in 80.0.3987.87

Event History

Feb 11, 2020

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-6414?

CVE-2020-6414 has been classified as a high severity vulnerability due to inadequate policy enforcement in the Chromium browser's Safe Browsing component.

How do I fix CVE-2020-6414?

To fix CVE-2020-6414, users should update their Chromium or Chrome browser to the latest patched version as specified in the security advisories.

What versions of Chromium are affected by CVE-2020-6414?