CVE-2018-6109
Last modified
CVE-2018-6109 is a vulnerability of currently unknown severity. readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.. EPSS estimates a 1.41% chance of exploitation in the next 30 days.
Description
readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chrome | < 66.0.3359.117 | |
| Debian | Debian Linux | 8.0 |
| Debian | Debian Linux | 9.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-6109?
How severe is CVE-2018-6109?
How do I fix CVE-2018-6109?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-6103A stagnant permission prompt in Prompts in Google Chrome pri…
- CVE-2018-6104Incorrect handling of confusable characters in URL Formatter…
- CVE-2018-6105Incorrect handling of confusable characters in Omnibox in Go…
- CVE-2018-6106An asynchronous generator may return an incorrect state in V…
- CVE-2018-6107Incorrect handling of confusable characters in URL Formatter…
- CVE-2018-6108Incorrect handling of confusable characters in URL Formatter…
- CVE-2018-6110Parsing documents as HTML in Downloads in Google Chrome prio…
- CVE-2018-6111An object lifetime issue in the developer tools network hand…
- CVE-2018-6112Making URLs clickable and allowing them to be styled in DevT…
- CVE-2018-6113Improper handling of pending navigation entries in Navigatio…
- CVE-2018-6114Incorrect enforcement of CSP for <object> tags in Blink in G…
- CVE-2018-6115Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in fil…
Are you affected by CVE-2018-6109?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST