Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2018-6110

chromium-browser: Incorrect handling of plaintext files via file://

Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6109

chromium-browser: Incorrect handling of files by FileAPI

readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6106

chromium-browser: Incorrect handling of promises in V8

An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6100

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Mac Os X Debian Linux Chrome and 4 more
CVE-2018-6097

chromium-browser: Fullscreen UI spoof

Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Macos Debian Linux Chrome and 4 more
CVE-2018-6096

chromium-browser: Fullscreen UI spoof

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6091

chromium-browser: Incorrect handling of plug-ins by Service Worker

Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6084

chromium-browser: Incorrect use of Distributed Objects in Google Software Updater on MacOS

Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Macos Debian Linux Chrome and 3 more
CVE-2018-6083

chromium-browser: incorrect processing of appmanifests

Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6082

chromium-browser: circumvention of port blocking

Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.

CVSS 3.0 · 4.7 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6080

chromium-browser: information disclosure in ipc call

Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to obtain memory metadata from privileged processes .

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6079

chromium-browser: information disclosure via texture data in webgl

Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6078

chromium-browser: url spoof in omnibox

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6077

chromium-browser: timing attack using svg filters

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6070

chromium-browser: csp bypass through extensions

Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6064

chromium-browser: type confusion in v8

Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 6.9% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6063

chromium-browser: incorrect permissions on shared memory

Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more