CVE-2018-17472
published 2018-11-14CVE-2018-17472: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a…
PriorityP341critical9.6CVSS 3.0
AVNACLPRNUIRSCCHIHAH
EPSS
1.49%
71.4th percentile
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a crafted HTML page.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| chrome | < 70.0.3538.67 | 70.0.3538.67 | |
| chrome | >= unspecified < 70.0.3538.67 | 70.0.3538.67 | |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.09.6CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.6CRITICAL
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xr8x-2h22-4fr9: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70
ghsa_unreviewed·2022-05-13
CVE-2018-17472 [CRITICAL] CWE-20 GHSA-xr8x-2h22-4fr9: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a crafted HTML page.
OSV
CVE-2018-17472: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70
osv·2018-11-14·CVSS 9.6
CVE-2018-17472 [CRITICAL] CVE-2018-17472: Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a crafted HTML page.
Red Hat
chromium-browser: iframe sandbox escape on iOS
vendor_redhat·2018-10-16·CVSS 9.6
CVE-2018-17472 [CRITICAL] chromium-browser: iframe sandbox escape on iOS
chromium-browser: iframe sandbox escape on iOS
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a crafted HTML page.
Package: chromium-browser (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/105666https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.htmlhttps://crbug.com/822518https://security.gentoo.org/glsa/201811-10http://www.securityfocus.com/bid/105666https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.htmlhttps://crbug.com/822518https://security.gentoo.org/glsa/201811-10
2018-11-14
Published