Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-13704

17
FAUCET Score

CVE-2019-13704 describes an insufficient policy enforcement vulnerability in Google Chrome versions prior to 78.0.3904.70, allowing a remote attacker to bypass Content Security Policy (CSP) via a specially crafted HTML page. This vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a low-impact integrity compromise requiring user interaction, but no confidentiality or availability impact. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 78.0.3904.70CPE match
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
15.0CPE matchmatch criteria
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

4.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.93%
Probability of exploitation in next 30 days
EPSS Percentile
56.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0093 is in the 69th percentile among its peer group of 26,234 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: chromium-browser-0:78.0.3904.70-1.el6_10
View patch

Vendor Advisories (1)

redhatCVE-2019-13704Moderate

chromium-browser: CSP bypass

Oct 22, 2019

References

lists.opensuse.org / opensuse-security-announce/2020-01/msg00008.html
chromereleases.googleblog.com / 2019/10/stable-channel-update-for-desktop_22.html
crbug.com / 1001283