Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Chromium on Debian can be tricked by crafted URLs

CVE-2019-5839 · published 7 years ago
Summary

The Chromium browser included in Debian may accept specially formed web addresses that bypass its normal checks. An attacker who can persuade a user to visit such a link could cause the browser to treat a malicious site as trusted. Update Chromium to the latest version or apply the vendor’s security patch to stop this behavior.

What to do
  • Update debian chromium to version 75.0.3770.80-1.
  • Update google chrome to version 75.0.3770.80 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chromium < 75.0.3770.80-1
Fix: upgrade to 75.0.3770.80-1
Debian:13 debian chromium < 75.0.3770.80-1
Fix: upgrade to 75.0.3770.80-1
Debian:14 debian chromium < 75.0.3770.80-1
Fix: upgrade to 75.0.3770.80-1
– google chrome < 75.0.3770.80
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
– opensuse backports sle-15
cpe:2.3:o:opensuse:backports:sle-15:-:*:*:*:*:*:*
– opensuse leap 15.0
15.1
42.3
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
– debian debian_linux 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
– fedoraproject fedora 29
30
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Original advisory text
Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
References
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published27 Jun 2019
Updated4 Nov 2026
First seen21 Sep 2026
Sources
DEBIAN-CVE-2019-5839 · OSV
CVE-2019-5839 · NVD
Track software like this
Free during beta