CVE-2020-6456: Medium severity Google Chrome vulnerability

Q: What is CVE-2020-6456?

CVE-2020-6456 is a vulnerability in Google Chrome that allows a local attacker to bypass site isolation through crafted clipboard contents.

Q: Which software versions are affected by CVE-2020-6456?

Google Chrome versions prior to 81.0.4044.92, Debian Linux 9.0 and 10.0, Fedoraproject Fedora 30, 31, and 32, Opensuse Backports sle-15-sp1, and openSUSE Leap 15.1.

Q: What is the severity of CVE-2020-6456?

CVE-2020-6456 has a severity rating of medium (6.5).

Q: How can I fix CVE-2020-6456?

To fix CVE-2020-6456, update to Google Chrome version 81.0.4044.92 or higher.

Q: Where can I find more information about CVE-2020-6456?

You can find more information about CVE-2020-6456 at the following references: [https://security-tracker.debian.org/tracker/CVE-2020-6456](https://security-tracker.debian.org/tracker/CVE-2020-6456), [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html), [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html).

Published Apr 13, 2020

Updated

Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents.

Affected Software

9 affected componentsFixes available

debian/chromium

90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1

Google Chrome<81.0.4044.92

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Fedoraproject Fedora=32

openSUSE Backports=sle-15-sp1

openSUSE Leap=15.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1

Event History

Apr 13, 2020

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-6456?

CVE-2020-6456 is a vulnerability in Google Chrome that allows a local attacker to bypass site isolation through crafted clipboard contents.

Which software versions are affected by CVE-2020-6456?

Google Chrome versions prior to 81.0.4044.92, Debian Linux 9.0 and 10.0, Fedoraproject Fedora 30, 31, and 32, Opensuse Backports sle-15-sp1, and openSUSE Leap 15.1.

What is the severity of CVE-2020-6456?

CVE-2020-6456 has a severity rating of medium (6.5).

How can I fix CVE-2020-6456?

To fix CVE-2020-6456, update to Google Chrome version 81.0.4044.92 or higher.

Where can I find more information about CVE-2020-6456?

You can find more information about CVE-2020-6456 at the following references: [https://security-tracker.debian.org/tracker/CVE-2020-6456](https://security-tracker.debian.org/tracker/CVE-2020-6456), [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html), [http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html](http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html).