CVE-2018-18344
Fixed in a distro release EPSS 1%
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.
Products: google chrome, debian_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | chromium | 71.0.3578.80-1 |
| Debian 12 | chromium | 71.0.3578.80-1 |
| Debian 13 | chromium | 71.0.3578.80-1 |
| Debian 14 | chromium | 71.0.3578.80-1 |
| Debian 9 | chromium-browser | 71.0.3578.80-1~deb9u1 |
| Red Hat rhel extras 6 | chromium-browser | 0:71.0.3578.80-1.el6_10 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:71.0.3578.80-1.el6_10 |
| SUSE Package Hub 12 SP2 | chromium | 71.0.3578.98-80.1 |
| Ubuntu 16.04 LTS | chromium-browser | 71.0.3578.80-0ubuntu0.16.04.1 |
| Ubuntu 18.04 LTS | chromium-browser | 71.0.3578.80-0ubuntu0.18.04.1 |
| openSUSE Tumbleweed | chromium | 93.0.4577.82-1.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |