CVE-2020-6425 — Improper Input Validation in Google Chrome
Severity
5.4MEDIUMNVD
EPSS
0.5%
top 35.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 23
Latest updateMay 24
Description
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5
Affected Packages4 packages
Also affects: Debian Linux 10.0, 9.0, Fedora 30, 31, 32
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-8jxx-qvw2-rx6p: Insufficient policy enforcement in extensions in Google Chrome prior to 80↗2022-05-24
CVEList▶
CVE-2020-6425: Insufficient policy enforcement in extensions in Google Chrome prior to 80↗2020-03-23
OSV▶
CVE-2020-6425: Insufficient policy enforcement in extensions in Google Chrome prior to 80↗2020-03-23
📋Vendor Advisories
3💬Community
3Bugzilla▶
CVE-2020-6424 CVE-2020-6425 CVE-2020-6426 CVE-2020-6427 CVE-2020-6428 CVE-2020-6429 CVE-2020-6449 chromium: various flaws [epel-all]↗2020-03-19
Bugzilla▶
CVE-2020-6424 CVE-2020-6425 CVE-2020-6426 CVE-2020-6427 CVE-2020-6428 CVE-2020-6429 CVE-2020-6449 chromium: various flaws [fedora-all]↗2020-03-19