CVE-2019-13727 — Improper Preservation of Permissions in Google Chrome

CWE-281 — Improper Preservation of Permissions10 documents8 sources

Severity

8.8HIGHNVD

EPSS

1.3%

top 20.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Debian Linux +5 more

Timeline

PublishedDec 10

Latest updateMay 24

Description

Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5google/chromeunspecified — 79.0.3945.79

▶NVDgoogle/chrome< 79.0.3945.79

▶Debianchromium/chromium< 79.0.3945.79-1+3

▶NVDredhat/enterprise_linux_server6.0

▶NVDredhat/enterprise_linux_desktop6.0

Also affects: Debian Linux 10.0, 9.0, Fedora 30, 31, Enterprise Linux 6.0

🔴Vulnerability Details

GHSA

GHSA-cg85-44qc-39mw: Insufficient policy enforcement in WebSockets in Google Chrome prior to 79↗2022-05-24

▶

OSV

CVE-2019-13727: Insufficient policy enforcement in WebSockets in Google Chrome prior to 79↗2019-12-10

▶

CVEList

CVE-2019-13727: Insufficient policy enforcement in WebSockets in Google Chrome prior to 79↗2019-12-10

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2019-13727↗2019-12-10

▶

Red Hat

chromium-browser: Insufficient policy enforcement in WebSockets↗2019-12-10

▶

Debian

CVE-2019-13727: chromium - Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.394...↗2019

▶

💬Community

Bugzilla

CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets↗2019-12-11

▶

Bugzilla

CVE-2019-13725 CVE-2019-13726 CVE-2019-13727 CVE-2019-13728 CVE-2019-13729 CVE-2019-13730 CVE-2019-13732 CVE-2019-13734 CVE-2019-13735 CVE-2019-13736 CVE-2019-13737 CVE-2019-13738 CVE-2019-13739 CVE-2↗2019-12-11

▶

Bugzilla

▶