PT-2018-3251 · Google+3 · Google Chrome+3
François Lajeunesse-Robert
·
Publicado
2018-05-29
·
Atualizado
2024-06-15
·
CVE-2018-6138
CVSS v2.0
8.8
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 67.0.3396.62
Description
The issue is related to insufficient policy enforcement in the Extensions API, allowing an attacker to bypass navigation restrictions. This can be achieved by convincing a user to install a malicious extension, which can then be used to exploit the weakness. The vulnerability exists due to inadequate input validation, enabling a remote attacker to circumvent navigation limitations using a specially crafted Chrome Extension.
Recommendations
For versions prior to 67.0.3396.62, update to version 67.0.3396.62 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to trusted sources and avoiding the use of unverified extensions.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Red Hat
Suse