CVE-2019-13667 describes an inappropriate implementation in the Omnibox (URL bar) of Google Chrome on iOS, specifically versions prior to 77.0.3865.75. This flaw allowed a remote attacker to spoof the contents of the Omnibox through a specially crafted HTML page, affecting Apple iPhone OS and Google Chrome on iOS. Rated as MEDIUM severity with a CVSS score of 4.3, this vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R). The potential impact is limited to low integrity (I:L), meaning an attacker could mislead users about the current website, but not execute code or access sensitive data. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, indicating low widespread attention to this particular vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 77.0.3865.75CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.