CVE-2018-20072 describes an insufficient data validation vulnerability in Google Chrome prior to version 73.0.3683.75, specifically within its PDF rendering component. This flaw allows a remote attacker to achieve out-of-bounds memory access by enticing a user to open a specially crafted PDF file. The vulnerability carries a CVSS v3.1 score of 7.8 (High), indicating a high potential for impact on confidentiality, integrity, and availability, with a low attack complexity requiring user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 73.0.3683.75CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
>= 73.0.3683.75, < 73.0.3683.75CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.