CVE-2018-6051

MEDIUM

Google Chrome < 64.0.3282.119 - Cross-Site Scripting via XSS Auditor Reporting URL

Title source: llm
STIX 2.1

Description

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.

References (6)

Core 6
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4103
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102797
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040282
Issue Tracking x_refsource_confirm
https://crbug.com/441275
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0265

Scores

CVSS v3 4.3
EPSS 0.0057
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE
CWE-79
Status published
Products (6)
debian/debian_linux 8.0
debian/debian_linux 9.0
google/chrome < 64.0.3282.119
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_server 6.0
redhat/enterprise_linux_workstation 6.0
Published Sep 25, 2018
Tracked Since Feb 18, 2026