CVE-2019-13758 : Security Advisory and Response

Remote attackers were able to bypass navigation restrictions in Google Chrome on Android due to insufficient policy enforcement.

Understanding CVE-2019-13758

What is CVE-2019-13758?

Insufficient policy enforcement in navigation in Google Chrome on Android allowed remote attackers to bypass navigation restrictions via a crafted HTML page.

The Impact of CVE-2019-13758

This vulnerability enabled remote attackers to bypass navigation restrictions in Google Chrome on Android versions prior to 79.0.3945.79 by exploiting the lack of adequate policy enforcement.

Technical Details of CVE-2019-13758

Vulnerability Description

Type: Insufficient policy enforcement
Attack Vector: Remote
Platform: Android
CVSS Score: 6.1 (Medium)

Affected Systems and Versions

Product: Chrome
Vendor: Google
Affected Version: < 79.0.3945.79

Exploitation Mechanism

Attackers utilized a specially designed HTML page to bypass navigation restrictions in Google Chrome on Android.

Mitigation and Prevention

Immediate Steps to Take

Update Google Chrome on Android to version 79.0.3945.79 or higher.
Avoid clicking on suspicious links or visiting untrusted websites.
Implement security best practices for web browsing.

Long-Term Security Practices

Regularly update software and applications to patch known vulnerabilities.
Educate users on safe browsing habits and the importance of software updates.
Employ security tools like antivirus software and firewalls.

Patching and Updates

Google released a stable channel update for desktop to address this vulnerability.
Refer to vendor advisories from Red Hat, openSUSE, Fedora, Debian, and Gentoo for specific patch information.