PT-2023-1344 · Google+4 · Google Chrome+4
Axel Chong
·
Publicado
2023-02-07
·
Atualizado
2025-03-20
·
CVE-2023-0700
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 110.0.5481.77
Description
The issue is related to an inappropriate implementation in the download functionality, allowing a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could be achieved by exploiting insufficient input validation. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
Recommendations
For Google Chrome versions prior to 110.0.5481.77, update to version 110.0.5481.77 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages to minimize the risk of exploitation. Avoid using the download functionality with untrusted sources until the issue is resolved.
Correção
UI Misrepresentation of Critical Information
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome
Suse
Ubuntu