CVE-2019-13705

CVE-2019-13705 is a medium-severity vulnerability affecting Google Chrome prior to version 78.0.3904.70, as well as related backports. It stems from insufficient policy enforcement in extensions, allowing a malicious extension to leak cross-origin data if a user is tricked into installing it. The attack requires user interaction (UI:R) and has low impact on confidentiality (C:L), with no integrity or availability impact. There is no evidence of active exploitation, nor are there public exploit modules or proof-of-concept code available, despite some community discussion and media coverage at the time of its disclosure.