{"id":"CVE-2018-6055","aliases":["DSA-4103-1","EUVD-2018-17818","GHSA-m6qv-gwg5-63c6","RHSA-2018:0265","UBUNTU-CVE-2018-6055"],"status":"published","title":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119...","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01143,"percentile":0.66914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-01-31T00:00:00Z","modified":"2026-06-29T10:19:07Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"chromium-browser","fixed_in":["64.0.3282.119-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:9","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"64.0.3282.119-1~deb9u1"}]}],"versions":["59.0.3071.104-1","59.0.3071.86-1","60.0.3112.72-1","60.0.3112.78-1","60.0.3112.78-1~deb9u1","61.0.3163.100-1","61.0.3163.100-1~deb9u1","61.0.3163.100-2","62.0.3202.75-1","62.0.3202.75-1~deb9u1","62.0.3202.89-1","62.0.3202.89-1~deb9u1","63.0.3239.30-1","63.0.3239.40-1","63.0.3239.84-1","63.0.3239.84-1~deb9u1"],"bundled":27},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:64.0.3282.119-1.el6_9"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"chromium-browser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:64.0.3282.119-1.el6_9"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.5-0ubuntu1","1.10.3-0ubuntu0.15.10.1","1.10.3-0ubuntu0.15.10.2","1.11.3-0ubuntu3","1.11.4-0ubuntu1","1.11.5-0ubuntu1","1.12.5-0ubuntu1","1.12.6-0ubuntu1","1.12.7-0ubuntu1","1.13.6-0ubuntu1","1.14.7-0ubuntu1","1.14.9-0ubuntu0.16.04.1","1.15.7-0ubuntu0.16.04.1","1.15.8-0ubuntu0.16.04.1","1.16.5-0ubuntu0.16.04.1","1.17.7-0ubuntu0.16.04.1","1.17.9-0ubuntu0.16.04.1","1.18.3-0ubuntu0.16.04.1","1.18.5-0ubuntu0.16.04.1","1.19.4-0ubuntu0.16.04.1","1.20.4-0ubuntu0.16.04.1","1.21.5-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"chromium-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"64.0.3282.119-0ubuntu1"}]}],"versions":["61.0.3163.100-0ubuntu1.1378","62.0.3202.62-0ubuntu0.17.10.1380","62.0.3202.89-0ubuntu1.1386","62.0.3202.94-0ubuntu1.1388","63.0.3239.84-0ubuntu1","63.0.3239.108-0ubuntu1"]}],"products":[{"vendor":"google","product":"chrome"}],"references":[{"url":"https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html","tags":["x_refsource_CONFIRM","x_transferred","article","report"]},{"url":"https://crbug.com/791003","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/105516","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6055","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m6qv-gwg5-63c6"},{"url":"https://access.redhat.com/errata/RHSA-2018:0265","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538511","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538526","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0265.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6031","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6032","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6033","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6034","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6036","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6036","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6039","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6041","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6043","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6043","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6045","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6045","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6046","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6047","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6048","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6048","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6049","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6051","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6052","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6053","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6054","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633393","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6055","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-6119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6119","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6055","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-6055","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","status":"published","published":"2018-09-25T14:00:00Z","modified":"2024-08-05T05:54:52.571Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-17818","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","status":"published","published":"2018-09-25T14:00:00Z","modified":"2024-08-05T05:54:52Z","updated_at":"2026-11-03T02:40:09.137362Z"}],"ghsa":[{"id":"GHSA-m6qv-gwg5-63c6","title":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119...","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","status":"published","published":"2022-05-14T01:57:54Z","modified":"2023-02-02T05:04:38Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:55.393577Z"}],"nvd":[{"id":"CVE-2018-6055","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","status":"published","published":"2018-09-25T14:29:04.227Z","modified":"2026-06-17T02:01:15.163Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"RHSA-2018:0265","title":"Red Hat Security Advisory: chromium-browser security update","status":"published","published":"2024-09-13T12:53:31Z","modified":"2026-06-29T10:19:07Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-6055","description":"Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.","status":"published","published":"2018-09-25T14:29:00Z","modified":"2026-04-22T11:59:44.64019Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"DSA-4103-1","title":"chromium-browser - security update","status":"published","published":"2018-01-31T00:00:00Z","modified":"2026-03-09T01:20:23.39805Z","updated_at":"2026-11-02T15:46:16.523846Z"}]}}