CVE-2018-20524

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is…

published December 27, 2018

CVSS
—
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy (CSP).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00707 · 52.9th percentile
Published
2018-12-27T17:00Z
EPSS history
Timeline
  • 27 DEC 17:00Z
    The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is…
    cvelistv5