CVE-2020-6385 — Improper Check for Unusual or Exceptional Conditions in Google Chrome

CWE-754 — Improper Check for Unusual or Exceptional Conditions CWE-20 — Improper Input Validation10 documents8 sources

Severity

8.8HIGHNVD

EPSS

1.4%

top 19.38%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Debian Linux +5 more

Timeline

PublishedFeb 11

Latest updateMay 24

Description

Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5google/chromeunspecified — 80.0.3987.87

▶NVDgoogle/chrome< 80.0.3987.87

▶Debianchromium/chromium< 80.0.3987.106-1+3

▶NVDopensuse/backports_sle15.0

▶NVDredhat/enterprise_linux_server6.0

Also affects: Debian Linux 10.0, 9.0, Fedora 30, 31

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

GHSA

GHSA-r9wv-87cr-24pw: Insufficient policy enforcement in storage in Google Chrome prior to 80↗2022-05-24

▶

CVEList

CVE-2020-6385: Insufficient policy enforcement in storage in Google Chrome prior to 80↗2020-02-11

▶

OSV

CVE-2020-6385: Insufficient policy enforcement in storage in Google Chrome prior to 80↗2020-02-11

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2020-6385↗2020-02-04

▶

Red Hat

chromium-browser: Insufficient policy enforcement in storage↗2020-02-04

▶

Debian

CVE-2020-6385: chromium - Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.8...↗2020

▶

💬Community

Bugzilla

CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-↗2020-02-11

▶

Bugzilla

▶

Bugzilla

CVE-2020-6385 chromium-browser: Insufficient policy enforcement in storage↗2020-02-10

▶