Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-13748: Chromium developer tools can let local attacker read memory
CVE-2019-13748 · published 6 years ago
Summary
The developer tools in Chromium versions before 79 on Debian do not properly enforce policies, so a user who runs a malicious web page on the same computer could extract data from the browser’s memory. This could expose confidential information such as passwords or personal data. Update Chromium to the latest version to close the gap.
What to do
- Update debian chromium to version 79.0.3945.79-1.
- Update google chrome to version 79.0.3945.79 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| Debian:13 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| Debian:14 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| – | chrome |
< 79.0.3945.79 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
30 31 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_desktop |
6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_for_scientific_computing |
6.0 cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_server |
6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_workstation |
6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:x64:* |
Original advisory text
Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML...
Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
References
- https://security-tracker.debian.org/tracker/CVE-2019-13748 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html Broken Link
- https://access.redhat.com/errata/RHSA-2019:4238 Third Party Advisory
- https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.... Vendor Advisory
- https://crbug.com/993706 Patch Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://seclists.org/bugtraq/2020/Jan/27 Mailing List Third Party Advisory
- https://security.gentoo.org/glsa/202003-08 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4606 Third Party Advisory
Severity
6.5
Medium
Type
CWE-862Missing Authorization
Timeline
Published10 Dec 2019
Updated4 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta