CVE-2019-25154: 
Google Chrome vulnerability analysis and mitigation

Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability was discovered by David Erceg on April 26, 2019, and was assigned a medium severity rating (Chrome Release, NVD).

The vulnerability was related to sandbox restrictions in Chrome's iframe implementation. The issue allowed partial bypass of sandbox restrictions within popup windows, enabling actions that should have been restricted by the sandbox, such as showing modal dialogs without the 'allow-modals' permission. The vulnerability received a CVSS v3.1 base score of 9.6 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker to bypass certain sandbox restrictions imposed on iframes, potentially leading to sandbox escape. This could enable actions that should have been restricted by the sandbox configuration, compromising the security boundaries established by the iframe sandbox mechanism (Chrome Release).

The vulnerability was fixed in Chrome version 77.0.3865.75. Users were advised to upgrade to this version or later to receive the security fix (Chrome Release).