PT-2023-4480 · Google+3 · Google Chrome+3
Igor Sak-Sakovskii
·
Publicado
2023-08-15
·
Atualizado
2025-09-29
·
CVE-2023-4357
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 116.0.5845.96
Description
The issue is related to insufficient validation of untrusted input in XML, allowing a remote attacker to bypass file access restrictions via a crafted HTML page. This can impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with the
document() method and external entities in Libxslt, enabling arbitrary file reading.Recommendations
For Google Chrome versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider restricting the use of XML-related features in Google Chrome until a patch is applied. Avoid using the
document() method with external entities in Libxslt to minimize the risk of exploitation.Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Google Chrome
Suse