Debian Chromium vulnerabilities

CVE-2019-5773 [MEDIUM] CVE-2019-5773: chromium - Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.... Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Scope: local bookworm: resolved (fixed in 72.0.3626.81-1) bullseye: resolved (fixed in 72.0.3626.81-1) forky: resolved (fixed in 72.0.3626.81-1) sid: resolved (fix

CVE-2020-6473 [MEDIUM] CVE-2020-6473: chromium - Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 ... Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Scope: local bookworm: resolved (fixed in 83.0.4103.83-1) bullseye: resolved (fixed in 83.0.4103.83-1) forky: resolved (fixed in 83.0.4103.83-1) sid: resolved (fixed in 83.

CVE-2020-6521 [MEDIUM] CVE-2020-6521: chromium - Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147... Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resolved (fi

CVE-2020-6563 [MEDIUM] CVE-2020-6563: chromium - Insufficient policy enforcement in intent handling in Google Chrome on Android p... Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resol

CVE-2020-15985 [MEDIUM] CVE-2020-15985: chromium - Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 all... Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resolved (fixed in 87.0.4280.88-0.1) trixie: resolved (fixed

CVE-2019-5766 [MEDIUM] CVE-2019-5766: chromium - Incorrect handling of origin taint checking in Canvas in Google Chrome prior to ... Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Scope: local bookworm: resolved (fixed in 72.0.3626.81-1) bullseye: resolved (fixed in 72.0.3626.81-1) forky: resolved (fixed in 72.0.3626.81-1) sid: resolved (fixed in 72.0.3626.81-1) trixie: reso

CVE-2019-5818 [MEDIUM] CVE-2019-5818: chromium - Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a re... Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Scope: local bookworm: resolved (fixed in 74.0.3729.108-1) bullseye: resolved (fixed in 74.0.3729.108-1) forky: resolved (fixed in 74.0.3729.108-1) sid: resolved (fixed in 74.0.3729.1

CVE-2020-6479 [MEDIUM] CVE-2020-6479: chromium - Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 a... Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. Scope: local bookworm: resolved (fixed in 83.0.4103.83-1) bullseye: resolved (fixed in 83.0.4103.83-1) forky: resolved (fixed in 83.0.4103.83-1) sid: resolved (fixed in 83.0.4103.83-1) trixie: resolved (fixed in 83.0

CVE-2020-6478 [MEDIUM] CVE-2020-6478: chromium - Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.... Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. Scope: local bookworm: resolved (fixed in 83.0.4103.83-1) bullseye: resolved (fixed in 83.0.4103.83-1) forky: resolved (fixed in 83.0.4103.83-1) sid: resolved (fixed in 83.0.4103.83-1) trixie: resolved (fixed in

CVE-2021-21181 [MEDIUM] CVE-2021-21181: chromium - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389... Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Scope: local bookworm: resolved (fixed in 89.0.4389.82-1) bullseye: resolved (fixed in 89.0.4389.82-1) forky: resolved (fixed in 89.0.4389.82-1) sid: resolved (fixed

CVE-2020-6487 [MEDIUM] CVE-2020-6487: chromium - Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103... Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Scope: local bookworm: resolved (fixed in 83.0.4103.83-1) bullseye: resolved (fixed in 83.0.4103.83-1) forky: resolved (fixed in 83.0.4103.83-1) sid: resolved (fixed in 83.0.4103.83-1) trixie: resol

CVE-2019-5784 [MEDIUM] CVE-2019-5784: chromium - Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96... Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Scope: local bookworm: resolved (fixed in 72.0.3626.109-1) bullseye: resolved (fixed in 72.0.3626.109-1) forky: resolved (fixed in 72.0.3626.109-1) sid: resolved (fixed in 72.0.3626.109-1) trixie:

CVE-2020-6491 [MEDIUM] CVE-2020-6491: chromium - Insufficient data validation in site information in Google Chrome prior to 83.0.... Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain name. Scope: local bookworm: resolved (fixed in 83.0.4103.83-1) bullseye: resolved (fixed in 83.0.4103.83-1) forky: resolved (fixed in 83.0.4103.83-1) sid: resolved (fixed in 83.0.4103.83-1) trixie: resolved (fi

CVE-2020-6565 [MEDIUM] CVE-2020-6565: chromium - Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.41... Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resolved (fixed in 87.0.428

CVE-2020-15977 [MEDIUM] CVE-2020-15977: chromium - Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4... Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resolved (fixed i

CVE-2019-5799 [MEDIUM] CVE-2019-5799: chromium - Incorrect inheritance of a new document's policy in Content Security Policy in G... Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page. Scope: local bookworm: resolved (fixed in 73.0.3683.75-1) bullseye: resolved (fixed in 73.0.3683.75-1) forky: resolved (fixed in 73.0.3683.75-1) sid: resolved (fixed i

CVE-2018-18345 [MEDIUM] CVE-2018-18345: chromium - Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0... Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page. Scope: local bookworm: resolved (fixed in 71.0.3578.80-1) bullseye: resolved (fixed in 71.0.3578.80-1) forky: resolved (fixed in 71.0.3578.80-1) si

CVE-2021-30540 [MEDIUM] CVE-2021-30540: chromium - Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472... Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-1) trixie: resolved (

CVE-2019-13744 [MEDIUM] CVE-2019-13744: chromium - Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.7... Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Scope: local bookworm: resolved (fixed in 79.0.3945.79-1) bullseye: resolved (fixed in 79.0.3945.79-1) forky: resolved (fixed in 79.0.3945.79-1) sid: resolved (fixed in 79.0.3945.79-1) trixie: resolved (fix

CVE-2020-6456 [MEDIUM] CVE-2020-6456: chromium - Insufficient validation of untrusted input in clipboard in Google Chrome prior t... Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted clipboard contents. Scope: local bookworm: resolved (fixed in 81.0.4044.92-1) bullseye: resolved (fixed in 81.0.4044.92-1) forky: resolved (fixed in 81.0.4044.92-1) sid: resolved (fixed in 81.0.4044.92-1) trixi