Cross Site Scripting Vulnerability in qutebrowser: Potential Browsing History Theft
Summary
CVE-2018-1000559: qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript... Affects qutebrowser across 3 version ranges.
< 1.3.3-1
< 4c9360237f186681b1e3f2a0f30c45161cf405c7
< 5a7869f2feaa346853d2a85413d6527c87ef0d9f
Fixed in 1.3.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qutebrowser is a keyboard-focused browser with a minimal GUI, designed for power users. It is built on PyQt5 and QtWebEngine, providing a unique browsing experience with a focus on keyboard shortcuts and a command-based interface. The vulnerability in question affects versions starting from v0.11.0, allowing malicious websites to exploit the browser's history command.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000559, is a Cross Site Scripting (XSS) issue that arises when a user visits a webpage with a specially crafted <title> attribute. If the user then accesses the qute://history page via the :history command, injected JavaScript can execute, potentially allowing an attacker to steal the user's browsing history. This vulnerability is particularly concerning as it can compromise user privacy and security.
How To Fix
Minimum fixed version
1.3.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qutebrowserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid accessing the qute://history page after visiting untrusted websites that may have manipulated the <title> attribute.
Conclusion
CVE-2018-1000559 is a significant XSS vulnerability in qutebrowser that can lead to the theft of browsing history. Users are strongly encouraged to update their software to the latest version to protect against this threat. Additionally, temporary workarounds can help mitigate risks until an upgrade is possible.
See every vulnerability recorded for qutebrowser →
FAQ
CVE-2018-1000559 is a Cross Site Scripting vulnerability in qutebrowser that can allow attackers to steal browsing history.
If you are using qutebrowser version 0.11.0 to 1.3.2, your installation is vulnerable. Upgrade to version 1.3.3 or later.
If you cannot upgrade, avoid accessing the qute://history page after visiting untrusted sites to mitigate the risk.
The vulnerability can lead to unauthorized access to a user's browsing history, compromising their privacy and security.
More information can be found on the official CVE database or by visiting the qutebrowser GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for qutebrowser.
