PT-2018-3251 · Google+3 · Google Chrome+3

François Lajeunesse-Robert · Published 2018-05-29 · Updated 2024-06-15 · CVE-2018-6138

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62

Description The issue is related to insufficient policy enforcement in the Extensions API, allowing an attacker to bypass navigation restrictions. This can be achieved by convincing a user to install a malicious extension, which can then be used to exploit the weakness. The vulnerability exists due to inadequate input validation, enabling a remote attacker to circumvent navigation limitations using a specially crafted Chrome Extension.

Recommendations For versions prior to 67.0.3396.62, update to version 67.0.3396.62 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to trusted sources and avoiding the use of unverified extensions.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1959

BDU:2019-04432

CVE-2018-6138

DSA-4237-1

MGASA-2018-0268

OPENSUSE-SU-2018_1484-1

OPENSUSE-SU-2018_2055-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2018:1815

RHSA-2018_1815

Affected Products

Alt Linux

Google Chrome

Red Hat

Suse

References · 2334

• 🔥 https://crbug.com/810220 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-6138 · Security Note
• https://advisories.mageia.org/MGASA-2018-0268.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6138 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6138 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04432 · Security Note
• https://ubuntu.com/security/CVE-2018-6138 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4237-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0268 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-21192 · Note
• https://suse.com/security/cve/CVE-2023-0129 · Note