CVE-2020-6439

Published: Apr 13, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.

Affected (8)

Products: Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Backports, Leap

1 product

1 product

1 product

2 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 81.0.4044.92

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Opensuse Backports	Version sle-15 sp1
Opensuse Leap	Version 15.1

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html

Source: chrome-cve-admin@google.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html

Source: chrome-cve-admin@google.com

Third Party Advisory

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html

Source: chrome-cve-admin@google.com

Release NotesVendor Advisory

https://crbug.com/868145

Source: chrome-cve-admin@google.com

Permissions RequiredVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/

Source: chrome-cve-admin@google.com

https://www.debian.org/security/2020/dsa-4714

Source: chrome-cve-admin@google.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://crbug.com/868145

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions RequiredVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2020/dsa-4714

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.