Launchpad.net

CVE 2018-20073

Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem.

See the CVE page on Mitre.org for more details.