CVE-2023-4077: Insufficient data validation in Extensions
Chromium: CVE-2023-4077 Insufficient data validation in Extensions
Other sources
Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-4077?
CVE-2023-4077 has been classified with a moderate severity level due to its impact on data processing.
How do I fix CVE-2023-4077?
To fix CVE-2023-4077, update your Microsoft Edge (Chromium-based) or Google Chrome to the latest version.
Which versions are affected by CVE-2023-4077?
CVE-2023-4077 affects Microsoft Edge versions up to 115.0.1901.200 and Google Chrome versions up to 115.0.5790.170.
Is CVE-2023-4077 present in Debian packages?
Yes, CVE-2023-4077 is present in Debian's Chromium package versions up to 90.0.4430.212-1~deb10u1.
What types of software are affected by CVE-2023-4077?
CVE-2023-4077 affects Chromium-based browsers, specifically Microsoft Edge and Google Chrome.