Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.

Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.

Security update for chromium

chromium-browser: Use-after-free in offline page fetcher chromium-browser: Use-after-poison in offline audio context chromium-browser: Object leak of utility functions chromium-browser: Memory corruption in regexp length check chromium-browser: Integer overflow in PDFium text rendering chromium-browser: Integer overflow in PDFium chromium-browser: Insufficient checks on filesystem: URI permissions chromium-browser: Comparison of -0 and null yields crash chromium-browser: Insufficient filtering of Open URL service parameters chromium-browser: res: URIs can load alternative browsers chromium-browser: Use-after-free in PDFium chromium-browser: Click location incorrectly checked chromium-browser: AppCache not robust to compromised renderers chromium-browser: Insufficient port filtering in CORS for extensions chromium-browser: Site isolation bypass from compromised renderer

Affected: Ubuntu:16.04:LTS: chromium-browser, Ubuntu:18.04:LTS: chromium-browser

Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.