chromium-browser: Cross origin information disclosure in Service Workers

Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6177

Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6164

Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2018-3292

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to insufficient origin checks for CSS content in Blink, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could enable an attacker t...

PT-2018-3271

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to a lack of protection for internal data in the Blink rendering engine of Google Chrome, allowing a remote attacker to potentially leak cross-origin data. This can ...

chromium-browser: Leak of visited status of page in Blink

CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6137

CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2018-3250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62 Description The issue is related to the CSS Paint API in Blink, which allowed a remote attacker to leak cross-origin data via a crafted HTML page. This is due to a lack of protection for sensitive...

chromium-browser: Same origin bypass in Service Worker

Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

chromium-browser: Incorrect handling of plug-ins by Service Worker

Service Workers can intercept any request made by an or tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6091

Service Workers can intercept any request made by an or tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6089

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...

PT-2018-17361

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera affected versions not specified Description The issue allows Service Workers to intercept requests made by or tags in the Fetch API, enabling a remote attacker to leak cross-origin data via a...

PT-2018-17363

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera affected versions not specified Description The issue is related to insufficient origin checks in Blink, allowing a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2018-17369

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 66.0.3359.117 Opera affected versions not specified Description A lack of CORS checks in Blink allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. Recommendations For Google Chro...

CVE-2018-6066

Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6079

Inappropriate sharing of TEXTURE2DARRAY/TEXTURE3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2018-6075

Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction...

CVE-2018-6077

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

PT-2018-17348

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 65.0.3325.146 Opera versions prior to 65.0.3325.146 Description The issue allows a remote attacker to leak cross-origin data via a crafted HTML page, due to displacement map filters being applied to cross-origin...