CVE-2018-6089 A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data vi...
MediumCVSS 6.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | < 66.0.3359.117 | 66.0.3359.117 |
| redhat linux desktop | = 6.0 | No fix listed |
| redhat linux server | = 6.0 | No fix listed |
| redhat linux workstation | = 6.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- 103917 vdb-entry
- RHSA-2018:1195 vendor-advisory
- chromereleases.googleblog.com
- crbug.com
- GLSA-201804-22 vendor-advisory
- DSA-4182 vendor-advisory