CVE-2019-18893: XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 7

Q: How do I fix CVE-2019-18893?

secure browser: downgrade or apply the listed mitigation; secure browser: downgrade or apply the listed mitigation; video downloader: upgrade to 1.5. Exact commands for each OS are on this page.

Q: Is CVE-2019-18893 being exploited?

CVE-2019-18893 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2019-18893 affect?

CVE-2019-18893 affects secure browser, secure browser, video downloader. Severity is medium (CVSS 6.1). XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browse

Q: How urgent is CVE-2019-18893?

Priority 46/100. Public exploit reference

This month

MEDIUM 6.1DOWNGRADEDOWNGRADEUPGRADE

CVE-2019-18893 is a medium-severity flaw (CVSS 6.1) affecting secure browser, secure browser, video downloader. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arb

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.8% (top 22%)
CISA exploited list	No
Weakness	CWE-79
Published	2020-01-13
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: avast · avg · video downloader project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-01-13 17:15 UTCPublished CVE record published
2026-06-17 02:25 UTCUpdated Record last modified

avast secure browser DOWNGRADE

Affected: 77.1.1831.91

Fixed in: no fixed release known

Safe to downgrade to: a release before 77.1.1831.91

1. Check installed version

apt-cache policy secure-browser || rpm -q secure-browser || secure-browser --version

2. No fixed release: DOWNGRADE to a release before 77.1.1831.91 (Debian / Ubuntu)

apt-cache madison secure-browser sudo apt install secure-browser=<VERSION_BEFORE_77.1.1831.91> sudo apt-mark hold secure-browser

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list secure-browser sudo dnf downgrade secure-browser-<VERSION_BEFORE_77.1.1831.91> sudo dnf versionlock add secure-browser

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

avg secure browser DOWNGRADE

Affected: 77.0.1790.77

Fixed in: no fixed release known

Safe to downgrade to: a release before 77.0.1790.77

1. Check installed version

apt-cache policy secure-browser || rpm -q secure-browser || secure-browser --version

2. No fixed release: DOWNGRADE to a release before 77.0.1790.77 (Debian / Ubuntu)

apt-cache madison secure-browser sudo apt install secure-browser=<VERSION_BEFORE_77.0.1790.77> sudo apt-mark hold secure-browser

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list secure-browser sudo dnf downgrade secure-browser-<VERSION_BEFORE_77.0.1790.77> sudo dnf versionlock add secure-browser

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

video downloader project video downloader UPGRADE

Affected: < 1.5

Fixed in: 1.5

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy video-downloader || rpm -q video-downloader || video-downloader --version

2. UPGRADE to 1.5 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade video-downloader

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade video-downloader

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-18893?

secure browser: downgrade or apply the listed mitigation; secure browser: downgrade or apply the listed mitigation; video downloader: upgrade to 1.5. Exact commands for each OS are on this page.

Is CVE-2019-18893 being exploited?

CVE-2019-18893 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-18893 affect?

CVE-2019-18893 affects secure browser, secure browser, video downloader. Severity is medium (CVSS 6.1). XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browse

How urgent is CVE-2019-18893?

Priority 46/100. Public exploit reference

References

← Back to latest CVEs