What’s Vulnerable › Vulnerabilities

CVE-2019-18893

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-13 · updated 2026-06-17
• Weakness: CWE-79

Description

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.

Affected products

• Avast Secure Browser: 77.1.1831.91
• AVG Secure Browser: 77.0.1790.77
• Video Downloader Project Video Downloader: before 1.5 — fixed in 1.5

How to fix

Upgrade to a fixed version: Video Downloader Project Video Downloader 1.5. Check the vendor advisory for mitigations.

References

• https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
• https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/

Get alerted when CVE-2019-18893 or the next vulnerability affects your stack