Google Chrome prior 71.0.3578.80 on iOS data URL HTML Page 7pk security

Summaryinfo

A vulnerability described as critical has been identified in Google Chrome on iOS. This issue affects some unknown processing of the component data URL Handler. Such manipulation as part of HTML Page leads to 7pk security. This vulnerability is traded as CVE-2018-20069. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Google Chrome on iOS (Web Browser). It has been rated as critical. Affected by this issue is an unknown code block of the component data URL Handler. The manipulation as part of a HTML Page leads to a 7pk security vulnerability. Using CWE to declare the problem leads to CWE-254. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.

The bug was discovered 12/04/2018. The weakness was shared 01/09/2019 (Website). The advisory is shared for download at chromereleases.googleblog.com. This vulnerability is handled as CVE-2018-20069 since 12/11/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 04/27/2020). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1211.

The vulnerability was handled as a non-public zero-day exploit for at least 36 days. During that time the estimated underground price was around $25k-$100k.

Upgrading to version 71.0.3578.80 eliminates this vulnerability.

The entries VDB-127833, VDB-127834, VDB-127835 and VDB-127836 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

License

• free

Website

• Vendor: https://www.google.com/
• Product: https://www.google.com/chrome/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion