CVE-2023-2939

2023-05-3022:15:10

Google

osv.dev

google chrome

installer

privilege escalation

symbolic link

windows

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

5.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.0%

JSON

Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)

CPENameOperatorVersion
chromiumeq109.0.5414.74-2
chromiumeq103.0.5060.53-1
chromiumeq108.0.5359.71-1
chromiumeq119.0.6045.199-1
chromiumeq116.0.5845.180-1
chromiumeq117.0.5938.62-1~deb11u1
chromiumeq83.0.4103.116-2
chromiumeq88.0.4324.182-1~deb10u1
chromiumeq99.0.4844.74-1~deb11u1
chromiumeq80.0.3987.162-1

Name	Operator	Version
chromium	eq	109.0.5414.74-2
chromium	eq	103.0.5060.53-1
chromium	eq	108.0.5359.71-1
chromium	eq	119.0.6045.199-1
chromium	eq	116.0.5845.180-1
chromium	eq	117.0.5938.62-1~deb11u1
chromium	eq	83.0.4103.116-2
chromium	eq	88.0.4324.182-1~deb10u1
chromium	eq	99.0.4844.74-1~deb11u1
chromium	eq	80.0.3987.162-1