CVE-2018-6125
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed...
6.5 MediumFix available
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
0.63%Up 0.1 points since Nov 3, 2021
What each source reports
NVD Score used
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
- Record
CVE-2018-6125- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
- Record
CVE-2018-6125- Updated
- 2026-11-02
EUVDEUVD-2018-17888 No score
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
- Record
EUVD-2018-17888- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6pfj-r5mc-55q9 No score
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed...
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
- Record
GHSA-6pfj-r5mc-55q9- Updated
- 2026-11-02
OSVRHSA-2018:1815
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2018:1815- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-6125
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
- Record
UBUNTU-CVE-2018-6125- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 |
before 67.0.3396.87-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1 Show 36 moreShow less61.0.3163.100-161.0.3163.100-1~deb9u161.0.3163.100-262.0.3202.75-162.0.3202.75-1~deb9u162.0.3202.89-162.0.3202.89-1~deb9u163.0.3239.30-163.0.3239.40-163.0.3239.84-163.0.3239.84-1~deb9u164.0.3282.119-164.0.3282.119-1~deb9u164.0.3282.119-265.0.3325.146-165.0.3325.146-265.0.3325.146-365.0.3325.146-465.0.3325.73-165.0.3325.74-166.0.3359.117-166.0.3359.117-1~deb9u166.0.3359.139-166.0.3359.181-166.0.3359.22-166.0.3359.22-266.0.3359.22-366.0.3359.26-166.0.3359.26-267.0.3396.48-167.0.3396.56-167.0.3396.57-167.0.3396.62-167.0.3396.62-267.0.3396.79-167.0.3396.79-2 |
67.0.3396.87-1~deb9u1 |
chromium-browserRed Hat:rhel_extras:6 |
before 0:67.0.3396.62-2.el6_9 | 0:67.0.3396.62-2.el6_9 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 |
before 0:67.0.3396.62-2.el6_9 | 0:67.0.3396.62-2.el6_9 |
chromium-browserUbuntu:16.04:LTS |
before 67.0.3396.99-0ubuntu0.16.04.2, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 31 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.1 |
67.0.3396.99-0ubuntu0.16.04.2 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
chromium-browserUbuntu:18.04:LTS |
before 67.0.3396.99-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 8 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.1 |
67.0.3396.99-0ubuntu0.18.04.1 |
chromiumopenSUSE:Tumbleweed |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6125 is a medium vulnerability (CVSS 6.5) in Google Chrome, published June 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in chromium-browser 67.0.3396.87-1~deb9u1.
References
crbug.com/818592
nvd.nist.gov/vuln/detail/CVE-2018-6125
github.com/advisories/GHSA-6pfj-r5mc-55q9
access.redhat.com/errata/RHSA-2018:1815
bugzilla.redhat.com/show_bug.cgi?id=1584032
Show 194 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1815.json
cve.org/CVERecord?id=CVE-2018-6123
chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html
ubuntu.com/security/CVE-2018-6125
suse.com/security/cve/CVE-2017-11215
This page doesn't list everything
Left out here: 2,209 references. The JSON record has them.