PT-2018-3200

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81 Description The issue is related to the chrome.debugger API in DevTools, which allowed an attacker to access local files without permission by convincing a user to install a malicious extension. Thi...

chromium-browser: Local file write in DevTools

The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted...

chromium-browser: UI spoof in Extensions

Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension...

CVE-2018-6178

Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension...

CVE-2018-6151

Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension...

PT-2018-3272

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to errors in security settings in the DevTools component of Google Chrome, allowing an attacker to exploit it by convincing a user to install a malicious extension...

July 24, 2018—KB4338817 (OS Build 16299.579)

None None...

chromium-browser: Restrictions bypass in the debugger extension API

Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension...

PT-2018-3252

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62 Description The issue is related to insufficient input validation in the chrome.debugger API DevTools of Google Chrome, allowing a remote attacker to convince a user to install a malicious extension...

FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)

Google Chrome Releases reports : 62 security fixes in this release : - 826626 Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28 - 827492 Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30 - 813876 High...

chromium-browser: Incorrect URL handling in DevTools

Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

chromium-browser: Heap-use-after-free in DevTools

An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page...

chromium-browser: Insufficient protection of remote debugging prototol in DevTools

A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server...

CVE-2018-6101

A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server...

PT-2018-17382

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera versions prior to 66.0.3359.117 Description The issue allowed a remote attacker to bypass navigation restrictions via a crafted HTML page by making URLs clickable and allowing them to be styl...

PT-2018-3280

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Description The issue is related to a bad cast in DevTools in Google Chrome, which allowed an attacker to perform an out of bounds memory read via a crafted Chrome Extension. This could be achieved...

PT-2018-17371

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera affected versions not specified Description A lack of host validation in DevTools allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote...

Directory Traversal

webkit-devtools-agent-frontend is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of ../ sanitization on the user input, allowing attackers to access files outside of the server's scope...

CVE-2017-15393

Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...

UBUNTU-CVE-2017-15393

Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...