PT-2023-8236 · Google · Google Chrome

CVE-2023-3742 · Publicado 2023-05-08 · Atualizado 2024-01-04

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 114.0.5735.90

Description The issue is related to insufficient policy enforcement in the Android Debug Bridge (ADB) component of Google Chrome on ChromeOS. This allows a local attacker with physical access to the device to bypass device policy restrictions. The severity of this issue is considered high.

Recommendations For Google Chrome on ChromeOS versions prior to 114.0.5735.90, update to version 114.0.5735.90 or later to resolve the issue. As a temporary workaround, consider restricting physical access to devices to minimize the risk of exploitation.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-280

CWE-264

Identificadores relacionados

BDU:2024-00266

CVE-2023-3742

Produtos afetados

Google Chrome

Referências · 10

• 🔥 https://crbug.com/1443292 · Exploit
• 🔥 https://bugs.chromium.org/p/chromium/issues/detail?id=1443292 · Exploit
• https://chromeos.dev/en/android-environment/deploying-apps · Nota
• https://t.me/cvenotify/66174 · Publicação no Telegram
• https://t.me/cvenotify/64438 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-00266 · Nota de Segurança
• https://twitter.com/CVEnew/status/1737497480546144375 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-3742 · Aviso do Fabricante
• https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3742 · Nota de Segurança