CVE-2020-15983
📋 TL;DR
This vulnerability allows a local attacker on ChromeOS devices to bypass Content Security Policy (CSP) protections by exploiting insufficient data validation in Chrome's webUI. Attackers could execute malicious scripts that would normally be blocked by CSP, potentially leading to data theft or further system compromise. Only ChromeOS devices running Chrome versions before 86.0.4240.75 are affected.
💻 Affected Systems
- Google Chrome on ChromeOS
📦 What is this software?
Backports Sle by Opensuse
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could bypass CSP to execute arbitrary JavaScript, potentially leading to session hijacking, credential theft, or installation of persistent malware.
Likely Case
Local privilege escalation or data exfiltration from the browser session through crafted malicious web pages.
If Mitigated
With proper CSP policies and browser sandboxing, impact would be limited to the browser session without system-wide compromise.
🎯 Exploit Status
Exploitation requires local access and crafting of malicious HTML pages. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 86.0.4240.75 and later
Vendor Advisory: https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
Restart Required: Yes
Instructions:
1. Open Chrome browser on ChromeOS device. 2. Click the three-dot menu → Help → About Google Chrome. 3. Chrome will automatically check for and install updates. 4. Click 'Relaunch' to restart Chrome with the updated version.
🔧 Temporary Workarounds
Disable local HTML file execution
allPrevent execution of local HTML files that could be crafted to exploit this vulnerability.
Not applicable - configure via Chrome policies or user education
Enhanced CSP policies
allImplement stricter Content Security Policy headers to limit script execution even if bypassed.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';
🧯 If You Can't Patch
- Restrict local user access to ChromeOS devices and implement strict user privilege management.
- Deploy network-level controls to block access to potentially malicious websites and monitor for unusual browser behavior.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: Open Chrome → Click three-dot menu → Help → About Google Chrome. If version is below 86.0.4240.75, the system is vulnerable.Check Version:
chrome://version/ in Chrome browser address barVerify Fix Applied:
Confirm Chrome version is 86.0.4240.75 or higher using the same About Google Chrome page.📡 Detection & Monitoring
Log Indicators:
- Unusual CSP violation logs
- Multiple failed CSP policy validations from single user sessions
Network Indicators:
- Unexpected outbound connections following local HTML file access
- Anomalous data transfers from ChromeOS devices
SIEM Query:
source="chrome_audit_logs" AND (event_type="csp_violation" AND count>10) OR (process="chrome" AND parent_process="local_html_file")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1076786
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://www.debian.org/security/2021/dsa-4824
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1076786
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://www.debian.org/security/2021/dsa-4824
