Security readout for executives and security teams
Plain-English summary
This flaw affects Google Chrome’s built-in PDF handling before version 73.0.3683.75. A malicious PDF could trigger memory access outside intended bounds after user interaction. The business risk is mainly legacy browser exposure, not broad current-browser exposure based on the supplied sources.
Executive priority
Treat this as a legacy-browser cleanup issue unless evidence shows old Chrome remains in production. Priority rises for shared workstations, kiosks, or systems that routinely open external PDFs.
Technical view
CVE-2018-20072 is insufficient data validation in Chrome PDF processing before 73.0.3683.75, allowing out-of-bounds memory access via a crafted PDF file. CVSS 3.1 is 7.8 with user interaction required and high confidentiality, integrity, and availability impacts. Chromium listed security severity as Low.
Likely exposure
Exposure is most likely on unmanaged, legacy, kiosk, lab, embedded, or frozen desktop environments running Chrome older than 73.0.3683.75. Current exposure cannot be confirmed from the supplied bundle.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. The described trigger is a crafted PDF file requiring user interaction. The CVSS vector lists local attack vector, while the description says remote attacker, so exposure modeling should treat that detail cautiously.
Researcher notes
The public bundle gives limited technical detail and only one Chromium issue reference. Do not infer exploitability beyond out-of-bounds memory access through crafted PDF handling. Note the mismatch between remote-attacker wording and CVSS AV:L.
Mitigation direction
- Inventory Chrome versions across managed and unmanaged endpoints.
- Remove or upgrade Chrome versions older than 73.0.3683.75.
- Check Google or Chromium guidance for any additional remediation details.
- Prioritize legacy systems that open untrusted PDF files.
Validation and detection
- Confirm endpoint telemetry reports Chrome version 73.0.3683.75 or later.
- Search asset inventories for legacy Chrome installations.
- Review browser management policy coverage for unmanaged endpoints.
- Check whether affected systems process PDFs from email or web downloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20072 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://issues.chromium.org/issues/40093560CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.