PT-2018-3191 · Google+1 · Google Chrome+1

Published 2018-09-04 · Updated 2019-10-03 · CVE-2018-16072

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81

Description The issue is related to a missing origin check in Blink, allowing a remote attacker to bypass the same origin policy via a crafted HTML page. This could potentially lead to unauthorized access to protected information. The vulnerability is associated with errors in the interaction between Chrome and Android MediaPlayer.

Recommendations For versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted HTML pages to minimize the risk of exploitation.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

ALT-PU-2018-2292

BDU:2019-04333

CVE-2018-16072

Affected Products

Alt Linux

Google Chrome

References · 10

• 🔥 https://crbug.com/864283 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04333 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16072 · Security Note
• https://ubuntu.com/security/CVE-2018-16072 · Vendor Advisory
• https://security.gentoo.org/glsa/201811-10 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16072 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16072 · Vendor Advisory
• http://securityfocus.com/bid/105215 · Note
• https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html · Note