PT-2018-3104 · Google+3 · Google Chrome+3
Rob Wu
·
Publicado
2018-01-02
·
Atualizado
2024-06-15
·
CVE-2018-6140
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 67.0.3396.62
Description
The issue concerns the chrome.debugger API in Google Chrome's DevTools, which allowed an attacker to execute arbitrary code via a crafted Chrome Extension if they convinced a user to install it. The vulnerability exists due to insufficient input validation in the Debugger API component, potentially allowing a remote attacker to execute arbitrary code using a specially crafted Chrome Extension.
Recommendations
For versions prior to 67.0.3396.62, update to version 67.0.3396.62 or later to resolve the issue. As a temporary workaround, consider disabling the use of the chrome.debugger API in DevTools until the update is applied. Restrict access to installing extensions to minimize the risk of exploitation. Avoid using the chrome.debugger API for attaching to Web UI pages in DevTools until the issue is resolved.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Red Hat
Suse