A vulnerability, which was classified as critical, has been found in Google Chrome (Web Browser). Affected by this issue is some unknown functionality of the component Blink. The manipulation as part of a HTML Page leads to a ui layer vulnerability. Using CWE to declare the problem leads to CWE-1021. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.

The weakness was presented 11/25/2019. This vulnerability is handled as CVE-2019-5861 since 01/09/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/27/2024). It is expected to see the exploit prices for this product increasing in the near future.

Upgrading to version 76.0.3809.87 eliminates this vulnerability.

See 146292, 146291, 146290 and 146289 for similar entries.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion