PT-2023-2565 · Google+1 · Google Chrome+1
Martin
·
Publicado
2023-02-27
·
Atualizado
2024-11-29
·
CVE-2023-2460
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 113.0.5672.63
Description
The issue is related to insufficient validation of untrusted input in Extensions, allowing an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. This could enable a remote attacker to bypass security restrictions and gain unauthorized access to protected information using a specially crafted malicious web page.
Recommendations
For versions prior to 113.0.5672.63, update to version 113.0.5672.63 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions from untrusted sources until the update is applied. Restrict access to sensitive files and information to minimize the risk of exploitation. Avoid using crafted HTML pages that could trigger the bypass of file access checks.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome