{"id":"CVE-2018-6084","aliases":["EUVD-2018-17847","GHSA-9q37-frcq-v33g","MGASA-2018-0268"],"status":"published","title":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0...","description":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01096,"percentile":0.65772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2018-06-04T15:11:47Z","modified":"2026-06-17T02:01:18Z","exploits":[{"source":"exploitdb","id":"EDB-44307","title":"Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation","type":"local","platform":"macos","date":"2018-03-20","verified":true,"url":"https://www.exploit-db.com/exploits/44307"}],"affected":[{"source":"osv","ecosystem":"Mageia:6","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"67.0.3396.62-1.mga6"}]}],"bundled":89}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"google","product":"chrome"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/44307/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103468","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://crbug.com/822424","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103917","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6084"},{"url":"https://github.com/advisories/GHSA-9q37-frcq-v33g"},{"url":"https://advisories.mageia.org/MGASA-2018-0268.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22138","tags":["report"]},{"url":"https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_22.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_13.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_15.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-6084","description":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.","status":"published","published":"2019-01-09T19:00:00Z","modified":"2024-08-05T05:54:52.953Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-17847","description":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.","status":"published","published":"2019-01-09T19:00:00Z","modified":"2024-08-05T05:54:52Z","updated_at":"2026-11-03T02:40:09.137362Z"}],"ghsa":[{"id":"GHSA-9q37-frcq-v33g","title":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0...","description":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.","status":"published","published":"2022-05-13T01:06:29Z","modified":"2023-02-01T05:02:55Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:49:59.47413Z"}],"nvd":[{"id":"CVE-2018-6084","description":"Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.","status":"published","published":"2019-01-09T19:29:03.76Z","modified":"2026-06-17T02:01:18.113Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:52.056758Z"}],"osv":[{"id":"MGASA-2018-0268","title":"Updated chromium-browser-stable packages fix security vulnerabilities","description":"Chromium-browser 67.0.3396.62 fixes security issues:\n\nMultiple flaws were found in the way Chromium 64.0.3282.140 processes various \ntypes of web content, where loading a web page containing malicious content \ncould cause Chromium to crash, execute arbitrary code, or disclose sensitive \ninformation. (CVE-2017-11215, CVE-2017-11225, CVE-2018-6056, CVE-2018-6057, \nCVE-2018-6060, CVE-2018-6061, CVE-2018-6062, CVE-2018-6063, CVE-2018-6064, \nCVE-2018-6065, CVE-2018-6066, CVE-2018-6067, CVE-2018-6068, CVE-2018-6069, \nCVE-2018-6070, CVE-2018-6071, CVE-2018-6072, CVE-2018-6073, CVE-2018-6074, \nCVE-2018-6075, CVE-2018-6076, CVE-2018-6077, CVE-2018-6078, CVE-2018-6079, \nCVE-2018-6080, CVE-2018-6081, CVE-2018-6082, CVE-2018-6083, CVE-2018-6084, \nCVE-2018-6085, CVE-2018-6086, CVE-2018-6087, CVE-2018-6088, CVE-2018-6089, \nCVE-2018-6090, CVE-2018-6091, CVE-2018-6092, CVE-2018-6093, CVE-2018-6094, \nCVE-2018-6095, CVE-2018-6096, CVE-2018-6097, CVE-2018-6098, CVE-2018-6099, \nCVE-2018-6100, CVE-2018-6101, CVE-2018-6102, CVE-2018-6103, CVE-2018-6104, \nCVE-2018-6105, CVE-2018-6106, CVE-2018-6107, CVE-2018-6108, CVE-2018-6109, \nCVE-2018-6110, CVE-2018-6111, CVE-2018-6112, CVE-2018-6113, CVE-2018-6114, \nCVE-2018-6115, CVE-2018-6116, CVE-2018-6117, CVE-2018-6118, CVE-2018-6120, \nCVE-2018-6121, CVE-2018-6122, CVE-2018-6123, CVE-2018-6124, CVE-2018-6126, \nCVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, \nCVE-2018-6132, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, \nCVE-2018-6137, CVE-2018-6138, CVE-2018-6139, CVE-2018-6140, CVE-2018-6141, \nCVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147)\n","status":"published","published":"2018-06-04T15:11:47Z","modified":"2026-04-16T06:24:23.231898893Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}