CVE-2018-6152

—

CVSS 3.0

9.6 critical

EPSS

1%p69

Published

Dec 4, 2018 (Dec 4, 2018)

Modified

Jun 17, 2026

Description

The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.

Vendors: google redhat debian
Products: chrome, enterprise linux desktop, enterprise linux server, enterprise linux workstation, debian linux
Weakness: CWE-434
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.