CVE-2023-2311: Insufficient policy enforcement in File System API

Reference Links

• https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html (Advisory)
• https://crbug.com/1354505
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B6SAST6CB5KKCQKH75ER2UQ3ICYPHCIZ/

Parent vulnerabilities

(Appears in the following advisories)

• 7031734922496241117

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-1810
• CVE-2023-1811
• CVE-2023-2313
• CVE-2023-1812
• CVE-2023-1813
• CVE-2023-1814
• CVE-2023-1815
• CVE-2023-1816
• CVE-2023-1817
• CVE-2023-1818
• CVE-2023-1819
• CVE-2023-1820
• CVE-2023-1821
• CVE-2023-1822
• CVE-2023-1823

Frequently Asked Questions

• What is the severity of CVE-2023-2311?

  The severity of CVE-2023-2311 is classified as Medium by Chromium security.

• How do I fix CVE-2023-2311?

  To fix CVE-2023-2311, update Google Chrome to version 112.0.5615.49 or later.

• What does CVE-2023-2311 exploit?

  CVE-2023-2311 exploits insufficient policy enforcement in the File System API within Google Chrome.

• Who is affected by CVE-2023-2311?

  Users of Google Chrome versions prior to 112.0.5615.49 are affected by CVE-2023-2311.

• Can CVE-2023-2311 be exploited remotely?

  Yes, CVE-2023-2311 allows remote attackers to bypass filesystem restrictions via a crafted HTML page.