Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-6114: Chrome and Linux browsers may let malicious pages bypass security

CVE-2018-6114 · published 7 years ago

Summary

Versions of Google Chrome before 66.0.3359.117 on Debian and Red Hat Linux can fail to block certain content in <object> tags, letting a crafted web page ignore your site's security rules. This could allow attackers to load unwanted scripts or data from other sites. Update Chrome to a newer version or apply the latest security patches provided by your Linux distribution.

What to do

Update google chrome to version 66.0.3359.117 or later.

Affected software

Vendor	Product	Affected versions
google	chrome	< 66.0.3359.117 `cpe:2.3:a:google:chrome::::::::`
debian	debian_linux	9.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`
redhat	enterprise_linux_desktop	6.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_workstation	6.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`

Original advisory text

Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published9 Jan 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-6114 · NVD

Track software like this

Free during beta