CVE-2018-16086

Removed by vendor...

CVE-2019-5838: Incorrect Authorization

Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension...

CVE-2018-16086: Improper Authorization

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-6138: Improper Input Validation

Insufficient policy enforcement in Extensions API in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-6176: Improper Input Validation

Insufficient file type enforcement in Extensions API in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted Chrome Extension...

CVE-2018-16064: Improper Input Validation

Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

PT-2019-4836

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to insufficient policy enforcement in the extensions API, allowing an attacker to bypass restrictions on file URIs via a crafted Chrome Extension. This could be...

PT-2018-13399

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81 Description The issue is related to insufficient policy enforcement in the extensions API, allowing an attacker who convinced a user to install a malicious extension to bypass navigation restriction...

chromium-browser: Local user privilege escalation in Extensions

Insufficient file type enforcement in Extensions API in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted Chrome Extension...

CVE-2018-6176

Insufficient file type enforcement in Extensions API in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted Chrome Extension...

PT-2018-3270

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to insufficient input validation in the chrome.downloads.open function and insufficient file type enforcement in the Extensions API. This could allow a remote attack...

PT-2018-13397

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 68.0.3440.75 Description The issue is related to insufficient data validation in the Extensions API, allowing an attacker to bypass navigation restrictions via a crafted Chrome Extension, if a user is convinced ...

CVE-2018-6138

Insufficient policy enforcement in Extensions API in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

PT-2018-3251

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62 Description The issue is related to insufficient policy enforcement in the Extensions API, allowing an attacker to bypass navigation restrictions. This can be achieved by convincing a user to instal...

CVE-2016-5201

A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page...

Design/Logic Flaw

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page...

CVE-2016-5218

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox URL bar via a crafted HTML page containing PDF data...

Design/Logic Flaw

A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page...

CVE-2016-5218

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox URL bar via a crafted HTML page containing PDF data...

CVE-2016-5218

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox URL bar via a crafted HTML page containing PDF data...