CVE-2020-6425

5.4 mediumEPSS 1.2%

Medium (5.4). EPSS 1.2% chance of exploitation in the next 30 days.

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-11-01)
CWE: CWE-20
Published: 2020-03-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
google:chrome
opensuse:backports

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html
https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html
https://crbug.com/1031670
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

Check your stack JSON