CVE-2020-6439
📋 TL;DR
This vulnerability in Google Chrome allows attackers to bypass security user interface (UI) warnings and prompts by exploiting insufficient policy enforcement during navigations. Attackers can craft malicious HTML pages that trick users into unsafe actions without proper security warnings. All users running vulnerable Chrome versions are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Backports by Opensuse
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass security warnings to execute arbitrary code, steal sensitive data, or perform unauthorized actions by tricking users into visiting malicious sites without proper security warnings.
Likely Case
Attackers craft phishing pages that bypass Chrome's security warnings, leading to credential theft, malware installation, or other social engineering attacks.
If Mitigated
With updated Chrome and proper user awareness, the risk is limited to users who still visit obviously malicious sites despite other security indicators.
🎯 Exploit Status
Exploitation requires user interaction (visiting a crafted HTML page) but doesn't require authentication. The bug report suggests relatively straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 81.0.4044.92
Vendor Advisory: https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click the three-dot menu. 3. Go to Help > About Google Chrome. 4. Chrome will automatically check for and install updates. 5. Click 'Relaunch' to restart Chrome with the fixed version.
🔧 Temporary Workarounds
Disable automatic navigation
allConfigure Chrome to require user confirmation for all navigations
chrome://flags/#disable-features=AutomaticTabDiscarding
Enable strict site isolation
allForce site isolation for all sites to limit impact
chrome://flags/#enable-site-per-process
🧯 If You Can't Patch
- Use alternative browsers until Chrome can be updated
- Implement network filtering to block suspicious domains and restrict web navigation
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: if version is less than 81.0.4044.92, the system is vulnerable.Check Version:
google-chrome --version (Linux) or open chrome://version in browserVerify Fix Applied:
Verify Chrome version is 81.0.4044.92 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual navigation patterns in Chrome logs
- Multiple security warning bypass attempts
Network Indicators:
- Traffic to domains hosting crafted HTML pages with unusual navigation patterns
SIEM Query:
source="chrome" AND (event="navigation" OR event="security_warning") AND status="bypassed"🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
- https://crbug.com/868145
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/
- https://www.debian.org/security/2020/dsa-4714
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00031.html
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html
- https://crbug.com/868145
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XWIVVYIQU67QR2LHNGGZBS4FZOW2RQO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFVP775RPRDVY5FUCN7ABH5AE74TQFDD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMXPDHEEACPD3BCMTC26SCCYB2ZMUOAO/
- https://www.debian.org/security/2020/dsa-4714
