CVE-2018-6122

chromium-browser: Type confusion in V8

Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2018-6121

chromium-browser: Privilege Escalation in extensions

Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2018-6120

chromium-browser: Heap buffer overflow in PDFium

An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6119

chromium-browser: Spoof of contents of the Omnibox (URL bar) via a crafted HTML page

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2018-6118

chromium-browser: Use after free in Media Cache

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2018-6117

chromium-browser: Confusing autofill settings

Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6116

chromium-browser: Incorrect low memory handling in WebAssembly

A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more

CVE-2018-6115

chromium-browser: SmartScreen bypass in downloads

Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2018-6114

chromium-browser: CSP bypass

Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6113

chromium-browser: URL spoof in Navigation

Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 1 more

Products

Macos Debian Linux Chrome and 4 more

CVE-2018-6112

chromium-browser: Incorrect URL handling in DevTools

Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6111

chromium-browser: Heap-use-after-free in DevTools

An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6110

chromium-browser: Incorrect handling of plaintext files via file://

Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6109

chromium-browser: Incorrect handling of files by FileAPI

readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6108

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more

CVE-2018-6107

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more

CVE-2018-6106

chromium-browser: Incorrect handling of promises in V8

An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6105

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more

CVE-2018-6104

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more

CVE-2018-6103

chromium-browser: UI spoof in Permissions

A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Linux Desktop and 3 more