Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-6096: Chrome before 66 can hide full-screen warning

CVE-2018-6096 · published 7 years ago

Summary

Google Chrome versions older than 66.0.3359.117 on Linux (including Debian and Red Hat editions) can be tricked by a malicious web page to cover the normal full‑screen notification. This could confuse users into thinking they are in a secure full‑screen mode when they are not, potentially enabling phishing or other deceptive actions. Update Chrome to the latest version (or the packaged version provided by your Linux distribution) to resolve the issue.

What to do

Update google chrome to version 66.0.3359.117 or later.

Affected software

Vendor	Product	Affected versions
google	chrome	< 66.0.3359.117 `cpe:2.3:a:google:chrome::::::::`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
redhat	enterprise_linux_desktop	6.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_workstation	6.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`

Original advisory text

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafte...

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published9 Jan 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-6096 · NVD

Track software like this

Free during beta