PT-2026-7613 · Unknown · Proctorio Chrome Extension

Caen Jones · Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2026-2345

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Baixa

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Proctorio Chrome Extension (affected versions not specified)

Description The Proctorio Chrome Extension, used for online proctoring, has multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. An internal messaging bridge processes messages based only on the presence of a fromWebsite property, without verifying the event.origin attribute. This insufficient origin validation could potentially allow malicious actors to send crafted messages to the extension.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2026-2345

Produtos afetados

Proctorio Chrome Extension

Referências · 3

• https://t.me/CVEtracker/44417 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2345 · Nota de Segurança
• https://hckrt.com/hacktivity/46b61f36-b685-4667-aebf-82a67ad69ad6 · Nota