PT-2018-3104 · Google+3 · Google Chrome+3

Rob Wu · Published 2018-01-02 · Updated 2024-06-15 · CVE-2018-6140

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62

Description The issue concerns the chrome.debugger API in Google Chrome's DevTools, which allowed an attacker to execute arbitrary code via a crafted Chrome Extension if they convinced a user to install it. The vulnerability exists due to insufficient input validation in the Debugger API component, potentially allowing a remote attacker to execute arbitrary code using a specially crafted Chrome Extension.

Recommendations For versions prior to 67.0.3396.62, update to version 67.0.3396.62 or later to resolve the issue. As a temporary workaround, consider disabling the use of the chrome.debugger API in DevTools until the update is applied. Restrict access to installing extensions to minimize the risk of exploitation. Avoid using the chrome.debugger API for attaching to Web UI pages in DevTools until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1959

BDU:2019-04035

CVE-2018-6140

DSA-4237-1

MGASA-2018-0268

OPENSUSE-SU-2018_1484-1

OPENSUSE-SU-2018_2055-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2018:1815

RHSA-2018_1815

Affected Products

Alt Linux

Google Chrome

Red Hat

Suse

References · 2342

• 🔥 https://crbug.com/798222 · Exploit
• https://bdu.fstec.ru/vul/2019-04035 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6140 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0268.html · Security Note
• https://ubuntu.com/security/CVE-2018-6140 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1815 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6140 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6140 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6140 · Security Note
• https://osv.dev/vulnerability/DSA-4237-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4237 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0268 · Vendor Advisory