CVE-2020-6435
First published: Mon Apr 13 2020(Updated: )
Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
Credit: chrome-cve-admin@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Chrome | <81.0.4044.92 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Fedoraproject Fedora | =30 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| Opensuse Backports | =sle-15-sp1 | |
| openSUSE Leap | =15.1 | |
| debian/chromium | 90.0.4430.212-1~deb10u1 116.0.5845.180-1~deb11u1 120.0.6099.129-1~deb11u1 119.0.6045.199-1~deb12u1 120.0.6099.129-1~deb12u1 120.0.6099.129-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2020-6435
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
- https://crbug.com/1032158
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/
- https://www.debian.org/security/2020/dsa-4714
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-6435.
What is the affected software for this vulnerability?
The affected software for this vulnerability includes Google Chrome prior to version 81.0.4044.92, Debian Linux 9.0 and 10.0, Fedora 30, 31, and 32, openSUSE Leap 15.1, and chromium on Debian.
What is the severity rating of CVE-2020-6435?
The severity rating of CVE-2020-6435 is medium (4.3).
How can an attacker exploit this vulnerability?
An attacker who has compromised the renderer process can exploit this vulnerability by bypassing navigation restrictions via a crafted HTML page.
How can I fix this vulnerability?
To fix this vulnerability, update Google Chrome to version 81.0.4044.92, Debian Linux to the recommended remedy versions, Fedora to the recommended remedy versions, openSUSE Leap to the recommended remedy version, or update chromium on Debian to the recommended remedy versions.
- collector/security-tracker-debian
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/google
- canonical/google chrome
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- vendor/opensuse
- canonical/opensuse backports
- version/opensuse backports/sle-15-sp1
- canonical/opensuse leap
- version/opensuse leap/15.1