Medium severity · published Jan 13, 2020
CVE-2019-18893
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of…
6.1
CVSS
1.8%
EPSS
No
On KEV
Description
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Secure Browser · Avast
77.1.1831.91 · source: NVD
VD
Video Downloader · Video Downloader Project
before 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18893
Exploit
https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
More from Secure Browser
7.8
CVE-2019-17190
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101