Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Chrome extensions can read private memory

CVE-2018-6151 · published 7 years ago
Summary

Google Chrome on Windows, Linux, macOS, Chrome OS and related Linux distributions can be tricked by a malicious extension to read data it shouldn't. This happens because of a coding error in the developer tools component. Update Chrome to the latest version to protect against this risk.

What to do
  • Update google chrome to version 66.0.3359.117 or later.
Affected software
VendorProductAffected versions
google chrome < 66.0.3359.117
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Original advisory text
Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memo...
Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published9 Jan 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-6151 · NVD
Track software like this
Free during beta