UBUNTU-CVE-2019-5793

Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page...

Google Chrome Competitive Conditions Vulnerability (CNVD-2019-16267)

Google Chrome is a web browser from Google, an American company. A competitive condition vulnerability exists in Extensions in versions prior to Google Chrome 73.0.3683.75, which can be exploited by remote attackers to execute arbitrary code on a system or cause a denial of service by tricking a...

WordPress Chrome-Extensions 1.0 Open Redirection

Exploit Title : WordPress Chrome-Extensions Themes 1.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 23/05/2019 Vendor Homepage : chrome-extensions.org - cssjockey.com Information Link : themesinfo.com/chrome-extensions-wordpress-theme-wwpx...

Microsoft Releases First Preview Builds of Chromium-based Edge Browser

Microsoft today finally released the first new reborn version of its Edge browser that the company rebuilds from scratch using Chromium engine, the same open-source web rendering engine that powers Google's Chrome browser. However, the Chromium-based Edge browser builds haven't yet entered the...

chromium-browser: Insufficient policy enforcement in Extensions

A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension...

Google Chrome Extensions Memory Misreference Vulnerability (CNVD-2019-03601)

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A memory misreference vulnerability exists in Extensions in versions prior to Google Chrome 71.0.3578.80. A remote attacker can exploit the vulnerability to corrupt the heap with the help of...

CVE-2018-6179

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

DEBIAN-CVE-2018-20066

Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2018-6169

Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page...

UBUNTU-CVE-2018-6179

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

CVE-2018-18344

Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension...

UBUNTU-CVE-2018-18344

Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension...

UBUNTU-CVE-2018-17477

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

How to tighten security and increase privacy on your browser

Is my browser making an effort to keep my system safe and my online behavior private? This is usually not the first question we ask ourselves when we choose our default browser. But maybe it should be. These days, threats to your privacy and security come at your from all angles, but browser-base...

chromium-browser: UI spoof in Extensions

Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page...

Google Announces 5 Major Security Updates for Chrome Extensions

Google has made several new announcements for its Chrome Web Store that aims at making Chrome extensions more secure and transparent to its users. Over a couple of years, we have seen a significant rise in malicious extensions that appear to offer useful functionalities, while running hidden...

chromium-browser: Local file information leak in Extensions

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

Google Chrome Extensions Local File Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A security vulnerability exists in Extensions in Google Chrome versions prior to 68.0.3440.75. A remote attacker can exploit the vulnerability to obtain sensitive information with the help of a...

Google Chrome Extensions Local User Elevation of Privilege Vulnerability

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A security vulnerability exists in Extensions in Google Chrome versions prior to 68.0.3440.75. A remote attacker can exploit the vulnerability to gain elevated privileges with the help of a...

Kicking the Rims – A Guide for Securely Writing and Auditing Chrome Extensions

A Thin Layer of Chrome Extension Security Prior-Art Chrome extension security and methodologies for auditing Chrome extensions for vulnerabilities appears to be a topic with shockingly little prior art. Especially when compared to other platforms such as Electron, which have had extension researc...