CVE-2020-6425

Published: Mar 23, 2020Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.

Affected (7)

Products: Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Backports

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 80.0.3987.149

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Opensuse Backports	Version sle-15 sp1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html

Source: chrome-cve-admin@google.com

Third Party Advisory

https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html

Source: chrome-cve-admin@google.com

Release NotesVendor Advisory

https://crbug.com/1031670

Source: chrome-cve-admin@google.com

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/

Source: chrome-cve-admin@google.com

https://security.gentoo.org/glsa/202003-53

Source: chrome-cve-admin@google.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4645

Source: chrome-cve-admin@google.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://crbug.com/1031670

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202003-53

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4645

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.