PT-2023-3335 · Google+4 · Google Chrome+4
Avaue
·
Publicado
2023-01-24
·
Atualizado
2024-10-17
·
CVE-2023-0474
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 109.0.5414.119
Description
The issue is related to a use after free in GuestView, which could potentially allow an attacker to exploit heap corruption via a Chrome web app if a user is convinced to install a malicious extension. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service, potentially through a specially crafted HTML page.
Recommendations
For Google Chrome versions prior to 109.0.5414.119, update to version 109.0.5414.119 or later to resolve the issue. As a temporary workaround, consider disabling the installation of extensions until the update is applied. Restrict access to Chrome web apps to minimize the risk of exploitation. Avoid using Chrome with untrusted or malicious extensions.
Correção
Use After Free
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome
Suse
Ubuntu