CVE-2018-6081

chromium-browser: xss in interstitials

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page.

Vulnerabilidades Cross-Site Scripting (XSS) en Interstitials en Google Chrome en versiones anteriores a la 65.0.3325.146 permitían que un atacante que convenció a un usuario para que instalase una extensión maliciosa o abriese la consola de desarrollador para inyectar scripts o HTML arbitrarios mediante una página HTML manipulada.

Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the execution of arbitrary code. Versions less than 65.0.3325.146 are affected.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-01-23 CVE Reserved
2018-03-12 CVE Published
2024-08-05 CVE Updated
2025-06-10 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (7)

URL	Tag	Source
http://www.securityfocus.com/bid/103297	Vdb Entry
https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html	X_refsource_confirm
https://crbug.com/797525	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2018:0484	2023-11-07
https://www.debian.org/security/2018/dsa-4182	2023-11-07
https://access.redhat.com/security/cve/CVE-2018-6081	2018-03-12
https://bugzilla.redhat.com/show_bug.cgi?id=1552498	2018-03-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				< 65.0.3325.146 Search vendor "Google" for product "Chrome" and version " < 65.0.3325.146"		-		Affected
Redhat Search vendor "Redhat"		Linux Desktop Search vendor "Redhat" for product "Linux Desktop"				6.0 Search vendor "Redhat" for product "Linux Desktop" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Linux Server Search vendor "Redhat" for product "Linux Server"				6.0 Search vendor "Redhat" for product "Linux Server" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Linux Workstation Search vendor "Redhat" for product "Linux Workstation"				6.0 Search vendor "Redhat" for product "Linux Workstation" and version "6.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected