Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Google Chrome before 66 may leak data across sites

CVE-2018-6099 · published 7 years ago
Summary

Versions of Google Chrome older than 66.0.3359.117 do not properly check cross-origin requests in the Blink engine. This can allow a malicious web page to read limited information from other sites visited by the user. Upgrade Chrome to version 66.0.3359.117 or later to resolve the issue.

What to do
  • Update google chrome to version 66.0.3359.117 or later.
Affected software
VendorProductAffected versions
redhat linux_desktop 6.0
cpe:2.3:o:redhat:linux_desktop:6.0:*:*:*:*:*:*:*
redhat linux_server 6.0
cpe:2.3:o:redhat:linux_server:6.0:*:*:*:*:*:*:*
redhat linux_workstation 6.0
cpe:2.3:o:redhat:linux_workstation:6.0:*:*:*:*:*:*:*
debian debian_linux 8.0
9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
google chrome < 66.0.3359.117
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Original advisory text
A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published4 Dec 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-6099 · NVD
Track software like this
Free during beta