CVE-2023-2460: Insufficient validation of untrusted input in Extensions
Chromium: CVE-2023-2460 Insufficient validation of untrusted input in Extensions
Other sources
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2460.
What is the severity of CVE-2023-2460?
The severity of CVE-2023-2460 is Medium.
Which software products are affected by CVE-2023-2460?
The software products affected by CVE-2023-2460 include Microsoft Edge (Chromium-based), Microsoft Edge, Google Chrome, Debian Debian Linux, and Fedoraproject Fedora.
How can an attacker exploit CVE-2023-2460?
An attacker can exploit CVE-2023-2460 by convincing a user to install a malicious extension and bypass file access checks via a crafted HTML page.
How can I fix CVE-2023-2460?
To fix CVE-2023-2460, update your software to the latest version provided by the vendor.