CVE-2020-16027 — Missing Authorization in Google Chrome

CWE-862 — Missing Authorization6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 75.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Google ChromeChromiumDebian Chromium+1 more
Timeline
PublishedJan 8
Latest updateMay 24

Description

Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5google/chromeunspecified — 87.0.4280.66
▶NVDgoogle/chrome< 87.0.4280.66
▶debiandebian/chromium< chromium 87.0.4280.88-0.1 (bookworm)
▶Debianchromium/chromium< 87.0.4280.88-0.1+3

🔴Vulnerability Details

2
GHSA
GHSA-m82m-22qc-g394: Insufficient policy enforcement in developer tools in Google Chrome prior to 87↗2022-05-24
▶
OSV
CVE-2020-16027: Insufficient policy enforcement in developer tools in Google Chrome prior to 87↗2021-01-08
▶

📋Vendor Advisories

3
Red Hat
chromium-browser: Insufficient policy enforcement in developer tools↗2020-11-17
▶
Chrome
Stable Channel Update for Desktop: CVE-2020-16027↗2020-11-17
▶
Debian
CVE-2020-16027: chromium - Insufficient policy enforcement in developer tools in Google Chrome prior to 87....↗2020
▶