Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execut…

Published 7 y ago 2019-01-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.1%

percentile 66%

Public exploits

Exploit-DB

Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.

Exploit prediction (EPSS)

1.10% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

Exploits and detections

EDB-44307 Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation · local · 2018-03-20

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.2	`AV:L/AC:L/Au:N/C:C/I:C/A:C`

Affected products

Google Chrome

Classification

Weakness

CWE-20 Improper Input Validation

Technology feeds

Google Chrome (RSS, critical only)

References

chromereleases.googleblog.com /2018/04/stable-channel-update-for-desktop.html · x_refsource_CONFIRM, x_transferred
exploit-db.com /exploits/44307/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
securityfocus.com /bid/103468 · vdb-entry, x_refsource_BID, x_transferred
crbug.com /822424 · x_refsource_MISC, x_transferred
securityfocus.com /bid/103917 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2018-6084
NVD: CVE-2018-6084

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary