PT-2020-5672 · Google+3 · Google Chrome+3
Gal Weizman
+3
·
Published
2020-07-14
·
Updated
2025-09-29
·
CVE-2020-6519
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 84.0.4147.89
Description
A policy bypass issue in the Content Security Policy (CSP) component of Google Chrome allowed a remote attacker to bypass content security policy via a crafted HTML page. The vulnerability is related to incorrect access control, which could allow a remote attacker to impact data integrity. It is estimated that almost every website in the world was at risk due to this issue. The vulnerability could potentially expose passwords in plain text through the user interface or in local files.
Recommendations
For Google Chrome versions prior to 84.0.4147.89, update to version 84.0.4147.89 or later to resolve the issue.
As a temporary workaround, consider restricting access to sensitive data and avoiding the use of plain text passwords in local files until the update is applied.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Google Chrome
Red Hat
Suse