CVE-2020-6392 describes an insufficient policy enforcement vulnerability in Google Chrome prior to version 80.0.3987.87, affecting various Linux distributions. An attacker could exploit this by convincing a user to install a malicious extension, thereby bypassing navigation restrictions. This is a medium severity vulnerability with a CVSS score of 4.3, requiring user interaction (UI:R) and having a low impact on integrity (I:L). There is no evidence of active exploitation, public exploit code, or significant community discussion, though it did receive some media coverage upon Chrome 80's release.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 80.0.3987.87CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
15.0CPE matchmatch criteria | cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* | ||
30CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | ||
31CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.