« Volver al listado

CVE-2018-16086

Estado: ModificadaMedia (5.4)—

La aplicación de políticas insuficientes en la API de extensiones en Google Chrome antes de 69.0.3497.81 permitió a un atacante que convenció a un usuario de instalar una extensión maliciosa para evitar las restricciones de navegación a través de una extensión de Chrome diseñada.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Chrome

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-16086",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "Google",
          "product": "Chrome",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "69.0.3497.81",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-27T17:15:11.757",
  "references": [
    {
      "url": "https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://crbug.com/844428",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://crbug.com/844428",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension."
    },
    {
      "lang": "es",
      "value": "La aplicación de políticas insuficientes en la API de extensiones en Google Chrome antes de 69.0.3497.81 permitió a un atacante que convenció a un usuario de instalar una extensión maliciosa para evitar las restricciones de navegación a través de una extensión de Chrome diseñada."
    }
  ],
  "lastModified": "2026-06-17T01:43:41.910",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECB006CE-58CC-4333-A303-C265D2B5EFC6",
              "versionEndExcluding": "69.0.3497.81"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}