Skip to content
OpenAdvisories
Unscored CVE-2018-20071 EUVD-2018-12646GHSA-fp62-x6pf-8qrh

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote…

Published Jan 9, 2019 · Updated Aug 5, 2024 · Assigned by Chrome

Vendor: Google Product: Chrome Category: Browsers

Description

Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page.

Affected products

VendorProductAffectedFixed
Google Chrome unspecified – < 70.0.3538.67 70.0.3538.67

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 chromium-browser 70.0.3538.67-1~deb9u1 DSA-4330-1

Advisories 1

References