Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Chrome | * | 78.0.3904.70 (excluding) | |
| Chromium-browser | Ubuntu | bionic | * |
| Chromium-browser | Ubuntu | devel | * |
| Chromium-browser | Ubuntu | disco | * |
| Chromium-browser | Ubuntu | eoan | * |
| Chromium-browser | Ubuntu | trusty | * |
| Chromium-browser | Ubuntu | upstream | * |
| Chromium-browser | Ubuntu | xenial | * |
| Red Hat Enterprise Linux 6 Supplementary | RedHat | chromium-browser-0:78.0.3904.70-1.el6_10 | * |