CVE-2020-6440: Medium severity Google Chrome vulnerability
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 81.0.4044.92 - Compensating control
Prevent users from installing untrusted/malicious Chrome extensions (e.g., restrict extension installation to trusted sources/allowlisted extensions) to mitigate the risk of crafted Chrome Extensions being installed.
Event History
Frequently Asked Questions
What is CVE-2020-6440?
CVE-2020-6440 is a vulnerability in Google Chrome and Debian Debian Linux that allows an attacker to obtain potentially sensitive information via a malicious Chrome Extension.
How does CVE-2020-6440 affect Google Chrome?
CVE-2020-6440 affects Google Chrome versions prior to 81.0.4044.92, allowing an attacker to obtain potentially sensitive information via a crafted Chrome Extension.
How does CVE-2020-6440 impact Debian Debian Linux?
CVE-2020-6440 impacts Debian Debian Linux versions 9.0, 10.0, and Debian Chromium packages, allowing an attacker to obtain potentially sensitive information via a malicious Chrome Extension.
What is the severity of CVE-2020-6440?
CVE-2020-6440 has a severity rating of 4.3, which is classified as medium.
How can I patch or fix CVE-2020-6440?
To fix CVE-2020-6440, update Google Chrome to version 81.0.4044.92 or higher, or update Debian Debian Linux to the recommended versions mentioned in the Debian security advisory.