CVE-2018-6160
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote...
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- Record
CVE-2018-6160- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- Record
CVE-2018-6160- Updated
- 2026-11-02
EUVDEUVD-2018-17923 No score
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- Record
EUVD-2018-17923- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6qcp-7hqx-rm6q
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote...
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- Record
GHSA-6qcp-7hqx-rm6q- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2018-0343 No score
Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser 68.0.3440.106 fixes security issues:
Multiple flaws were found in the way Chromium 67.0.3396.87 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-4117, CVE-2018-6044, CVE-2018-6153, CVE-2018-6154, CVE-2018-6155, CVE-2018-6156, CVE-2018-6157, CVE-2018-6158, CVE-2018-6159, CVE-2018-6160, CVE-2018-6161, CVE-2018-6162, CVE-2018-6163, CVE-2018-6164, CVE-2018-6165, CVE-2018-6166, CVE-2018-6167, CVE-2018-6168, CVE-2018-6169, CVE-2018-6170, CVE-2018-6171, CVE-2018-6172, CVE-2018-6173, CVE-2018-6174, CVE-2018-6175, CVE-2018-6176, CVE-2018-6177, CVE-2018-6178, CVE-2018-6179)
Upstream also reported for release 68.0.3440.75 that three additional flaws were fixed in earlier (unspecified) chromium releases but not listed in the release notes for those releases. (CVE-2018-6150, CVE-2018-6151, CVE-2018-6152)
- Record
MGASA-2018-0343- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browser-stableMageia:6 From an advisory covering 32 CVEs |
before 68.0.3440.106-1.mga6 | 68.0.3440.106-1.mga6 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6160 is a medium vulnerability (CVSS 6.5) in Google Chrome, published August 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. No source names a fixed version.
References
chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
security.gentoo.org/glsa/201808-01
securityfocus.com/bid/104887
crbug.com/839822
nvd.nist.gov/vuln/detail/CVE-2018-6160
github.com/advisories/GHSA-6qcp-7hqx-rm6q
Show 194 moreShow less
advisories.mageia.org/MGASA-2018-0343.html
bugs.mageia.org/show_bug.cgi?id=23364
suse.com/security/cve/CVE-2017-11215
Left out here: 2,121 references. The JSON record has them.