PT-2018-3196

CVE-2018-16077

Published

2018-09-04

Updated

2024-06-15

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81

Description The issue is related to an object lifecycle problem in Blink, a component of Google Chrome, which allows a remote attacker to bypass content security policy. This can be achieved via a crafted HTML page, potentially impacting the integrity of protected information due to insufficient input validation.

Recommendations For Google Chrome versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Manuel Caballero

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-20: Improper Input Validation