XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.
CPE | Name | Operator | Version |
---|---|---|---|
debian_linux | eq | 8.0 | |
debian_linux | eq | 9.0 | |
chrome | lt | 64.0.3282.119 | |
enterprise_linux_desktop | eq | 6.0 | |
enterprise_linux_server | eq | 6.0 | |
enterprise_linux_workstation | eq | 6.0 |