CVE-2018-6152 The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinc...
CriticalCVSS 9.6
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | < 66.0.3359.106 | 66.0.3359.106 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Google Chrome | < 66.0.3359.117 | 66.0.3359.117 |
References
- 104887 vdb-entry
- RHSA-2018:2282 vendor-advisory
- chromereleases.googleblog.com
- crbug.com
- GLSA-201808-01 vendor-advisory
- DSA-4256 vendor-advisory