CVE-2020-6406

chromium-browser: Use after free in audio

Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Debian Fedoraproject Google and 2 more

Products

Debian Linux Fedora Chrome and 6 more

CVE-2020-6404

chromium-browser: Inappropriate implementation in Blink

Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6403

chromium-browser: Incorrect security UI in Omnibox

Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 4 more

Products

Iphone Os Debian Linux Fedora and 8 more

CVE-2020-6402

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 4 more

Products

Macos Debian Linux Fedora and 8 more

CVE-2020-6400

chromium-browser: Inappropriate implementation in CORS

Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6398

chromium-browser: Uninitialized use in PDFium

Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6397

chromium-browser: Incorrect security UI in sharing

Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6396

chromium-browser: Inappropriate implementation in Skia

Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6394

chromium-browser: Insufficient policy enforcement in Blink

Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6393

chromium-browser: Insufficient policy enforcement in Blink

Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6392

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6391

chromium-browser: Insufficient validation of untrusted input in Blink

Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6390

chromium-browser: Out of bounds memory access in streams

Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6386

chromium-browser: Use after free in speech

Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2020-6385

chromium-browser: Insufficient policy enforcement in storage

Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6384

chromium-browser: Use after free in WebAudio

Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2020-6383

chromium-browser: Type confusion in V8

Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2020-6382

chromium-browser: Type Confusion in JavaScript

Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Chrome and 7 more

CVE-2020-6381

chromium-browser: Integer overflow in JavaScript

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Debian Fedoraproject Google and 3 more

Products

Debian Linux Fedora Android and 9 more

CVE-2020-3864

webkitgtk: Non-unique security origin for DOM object contexts

A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Icloud Ipados Iphone Os and 7 more