PT-2023-3624 · Google+2 · Google Chrome+2
Ndevtk
·
Publicado
2023-05-30
·
Atualizado
2025-03-11
·
CVE-2023-2937
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 114.0.5735.90
Description
The issue is related to an inappropriate implementation in the Picture In Picture technology of Google Chrome, which may allow a remote attacker to conduct phishing attacks by spoofing the contents of the Omnibox (URL bar) via a crafted HTML page. This can be achieved if the attacker has compromised the renderer process. The estimated number of potentially affected devices is not specified.
Recommendations
For Google Chrome versions prior to 114.0.5735.90, update to version 114.0.5735.90 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Picture In Picture feature until a patch is available. Avoid using crafted HTML pages that may exploit this issue.
Correção
UI Misrepresentation of Critical Information
Improperly Implemented Security Check for Standard
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome