CVE-2018-6070 - chromium-browser: csp bypass through extensions

Back Back to CVE browser

MEDIUM

chromium-browser: csp bypass through extensions

Published Nov 14, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 0.85%

Description

Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.

Affected products

Vendor Google Product Chrome Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <65.0.3325.146

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google

Chrome

n/a

Version	Status	Constraints
unspecified	affected	<65.0.3325.146

Red Hat Enterprise Linux 6 Supplementary

chromium-browser-0:65.0.3325.146-2.el6_9

Fixed · RHSA-2018:0484

Product	Package	State	Advisory
Red Hat Enterprise Linux 6 Supplementary	chromium-browser-0:65.0.3325.146-2.el6_9	Fixed	RHSA-2018:0484

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (9)

http://www.securityfocus.com/bid/103297
vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:0484
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-6070
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1552487
Issue Tracking
https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html
x_refsource_CONFIRM
https://crbug.com/668645
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2018-6070
https://www.cve.org/CVERecord?id=CVE-2018-6070
https://www.debian.org/security/2018/dsa-4182
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
http://www.securityfocus.com/bid/103297		vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:0484		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-6070		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1552487		Issue Tracking
https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html		x_refsource_CONFIRM
https://crbug.com/668645		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2018-6070
https://www.cve.org/CVERecord?id=CVE-2018-6070
https://www.debian.org/security/2018/dsa-4182		vendor-advisoryx_refsource_DEBIAN