CVE-2019-13692
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a...
8.8 HighFix available
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.72%Up 0.4 points since Apr 14, 2021
What each source reports
NVD Score used
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
CVE-2019-13692- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
CVE-2019-13692- Updated
- 2026-11-02
EUVDEUVD-2019-5112 No score
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
EUVD-2019-5112- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frm6-q76c-62mx No score
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a...
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
GHSA-frm6-q76c-62mx- Updated
- 2026-11-02
OSV
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
CVE-2019-13692- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13692
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
DEBIAN-CVE-2019-13692- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:3211
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2019:3211- CVSS 3.0
- 9.6 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13692
Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.
- Record
UBUNTU-CVE-2019-13692- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 78.0.3904.87-1 | 78.0.3904.87-1 |
chromiumDebian:13 |
before 78.0.3904.87-1 | 78.0.3904.87-1 |
chromiumDebian:14 |
before 78.0.3904.87-1 | 78.0.3904.87-1 |
chromiumDebian:10 From an advisory covering 71 CVEs |
before 78.0.3904.97-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 7 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.87-1 |
78.0.3904.97-1~deb10u1 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 46 CVEs |
before 0:77.0.3865.120-2.el6_10 | 0:77.0.3865.120-2.el6_10 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 46 CVEs |
before 0:77.0.3865.120-2.el6_10 | 0:77.0.3865.120-2.el6_10 |
chromium-browserUbuntu:16.04:LTS |
before 77.0.3865.90-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 |
77.0.3865.90-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 77.0.3865.90-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 26 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.1 |
77.0.3865.90-0ubuntu0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13692 is a high vulnerability (CVSS 8.8) in Google Chrome, published November 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in chromium 78.0.3904.87-1.
References
chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
crbug.com/991888
nvd.nist.gov/vuln/detail/CVE-2019-13692
github.com/advisories/GHSA-frm6-q76c-62mx
security-tracker.debian.org/tracker/CVE-2019-13692
access.redhat.com/errata/RHSA-2019:3211
Show 188 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1762366
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3211.json
cve.org/CVERecord?id=CVE-2019-5870
ubuntu.com/security/CVE-2019-13692
This page doesn't list everything
Left out here: 2 versions. The JSON record has them.