CVE-2018-6095 — Sensitive Information Exposure in Google Chrome

CWE-200 — Sensitive Information Exposure8 documents6 sources

Severity

6.5MEDIUMNVD

EPSS

0.9%

top 23.78%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Debian Linux Redhat Linux Desktop +2 more

Timeline

PublishedDec 4

Latest updateMay 14

Description

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5google/chromeunspecified — 66.0.3359.117

▶NVDgoogle/chrome< 66.0.3359.117

▶NVDredhat/linux_server6.0

▶NVDredhat/linux_desktop6.0

▶NVDredhat/linux_workstation6.0

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

GHSA

GHSA-3xf8-vx6f-3f9h: Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66↗2022-05-14

▶

CVEList

CVE-2018-6095: Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66↗2018-12-04

▶

OSV

CVE-2018-6095: Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66↗2018-12-04

▶

📋Vendor Advisories

Red Hat

chromium-browser: Lack of meaningful user interaction requirement before file upload↗2018-04-17

▶

💬Community

Bugzilla

CVE-2018-6085 CVE-2018-6086 CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090 CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094 CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098 CVE-↗2018-04-18

▶

Bugzilla

CVE-2018-6095 chromium-browser: Lack of meaningful user interaction requirement before file upload↗2018-04-18

▶

Bugzilla

▶