CVE-2019-13737 — Sensitive Information Exposure in Google Chrome

CWE-200 — Sensitive Information Exposure10 documents8 sources

Severity

6.5MEDIUMNVD

EPSS

2.6%

top 14.44%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Debian Linux +5 more

Timeline

PublishedDec 10

Latest updateMay 24

Description

Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5google/chromeunspecified — 79.0.3945.79

▶NVDgoogle/chrome< 79.0.3945.79

▶Debianchromium/chromium< 79.0.3945.79-1+3

▶NVDredhat/enterprise_linux_server6.0

▶NVDredhat/enterprise_linux_desktop6.0

Also affects: Debian Linux 10.0, 9.0, Fedora 30, 31, Enterprise Linux 6.0

🔴Vulnerability Details

GHSA

GHSA-56ww-7836-2fcq: Insufficient policy enforcement in autocomplete in Google Chrome prior to 79↗2022-05-24

▶

CVEList

CVE-2019-13737: Insufficient policy enforcement in autocomplete in Google Chrome prior to 79↗2019-12-10

▶

OSV

CVE-2019-13737: Insufficient policy enforcement in autocomplete in Google Chrome prior to 79↗2019-12-10

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2019-13737↗2019-12-10

▶

Red Hat

chromium-browser: Insufficient policy enforcement in autocomplete↗2019-12-10

▶

Debian

CVE-2019-13737: chromium - Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3...↗2019

▶

💬Community

Bugzilla

CVE-2019-13725 CVE-2019-13726 CVE-2019-13727 CVE-2019-13728 CVE-2019-13729 CVE-2019-13730 CVE-2019-13732 CVE-2019-13734 CVE-2019-13735 CVE-2019-13736 CVE-2019-13737 CVE-2019-13738 CVE-2019-13739 CVE-2↗2019-12-11

▶

Bugzilla

CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete↗2019-12-11

▶

Bugzilla

▶