CVE-2020-15973: Insufficient policy enforcement in extensions
Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2020-15967
- CVE-2020-15968
- CVE-2020-15969
- CVE-2020-15970
- CVE-2020-15971
- CVE-2020-15972
- CVE-2020-15990
- CVE-2020-15991
- CVE-2020-15974
- CVE-2020-15975
- CVE-2020-15976
- CVE-2020-6557
- CVE-2020-15977
- CVE-2020-15978
- CVE-2020-15979
- CVE-2020-15980
- CVE-2020-15981
- CVE-2020-15982
- CVE-2020-15983
- CVE-2020-15984
- CVE-2020-15985
- CVE-2020-15986
- CVE-2020-15987
- CVE-2020-15992
- CVE-2020-15988
- CVE-2020-15989
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-15973.
What is the title of the vulnerability?
The title of the vulnerability is 'Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker to bypass same origin policy via a crafted Chrome Extension'.
What is the severity of CVE-2020-15973?
The severity of CVE-2020-15973 is medium with a severity score of 6.5.
Which software versions are affected by this vulnerability?
Google Chrome versions prior to 86.0.4240.75, Fedora 31, Fedora 32, Fedora 33, openSUSE Backports SLE 15.0-sp2, Debian Debian Linux 10.0, and Chromium versions 90.0.4430.212-1~deb10u1, 116.0.5845.180-1~deb11u1, 118.0.5993.117-1~deb11u1, 116.0.5845.180-1~deb12u1, 118.0.5993.117-1~deb12u1, 118.0.5993.117-1, and 119.0.6045.105-1 are affected.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by convincing a user to install a malicious extension, which allows them to bypass the same origin policy via a crafted Chrome Extension.