CVE-2023-2460: Insufficient validation of untrusted input in Extensions
Chromium: CVE-2023-2460 Insufficient validation of untrusted input in Extensions
Other sources
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 113.0.5672.63 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 113.0.5672.63
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2460.
What is the severity of CVE-2023-2460?
The severity of CVE-2023-2460 is Medium.
Which software products are affected by CVE-2023-2460?
The software products affected by CVE-2023-2460 include Microsoft Edge (Chromium-based), Microsoft Edge, Google Chrome, Debian Debian Linux, and Fedoraproject Fedora.
How can an attacker exploit CVE-2023-2460?
An attacker can exploit CVE-2023-2460 by convincing a user to install a malicious extension and bypass file access checks via a crafted HTML page.
How can I fix CVE-2023-2460?
To fix CVE-2023-2460, update your software to the latest version provided by the vendor.