PT-2023-9326 · Google+2 · Google Chrome+2

Axel Chong · Publicado 2023-10-31 · Atualizado 2024-12-26 · CVE-2023-7011

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 119.0.6045.105

Description The issue is related to the Picture in Picture technology in Google Chrome, where a remote attacker can exploit it to spoof the contents of the URL bar using a specially crafted HTML page. This can lead to the distortion of important information in the user interface.

Recommendations For versions prior to 119.0.6045.105, update to version 119.0.6045.105 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Picture in Picture feature until a patch is applied. Avoid using specially crafted HTML pages that can exploit this issue.

Exploit

Correção

UI Misrepresentation of Critical Information

Enumeração de Fraquezas

CWE-451

Identificadores relacionados

BDU:2024-06515

CVE-2023-7011

DSA-5546-1

Produtos afetados

Astra Linux

Google Chrome

Red Os

Referências · 12

• 🔥 https://issues.chromium.org/issues/40066780 · Exploit
• https://osv.dev/vulnerability/DSA-5546-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-7011 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-7011 · Nota de Segurança
• https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-7011 · Aviso do Fabricante
• https://crbug.com/40066780 · Nota
• https://t.me/cvenotify/86443 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-06515 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-chromium-cve-2023-7011-cve-2023-7012-cve-2023-7010-cve-2023-4860 · Nota
• https://osv.dev/vulnerability/CVE-2023-7011 · Aviso do Fabricante