Access Restriction Bypass

chromium is vulnerable to Access Restriction Bypass. The vulnerability exists due to inappropriate implementation in Extensions in Google Chrome which allows a remote attacker who had compromised the renderer process to spoof extension storage via a crafted HTML page...

Improper Input Validation

chromium is vulnerable to Improper Input Validation. The vulnerability exists due to the lack of user input validation in the Extensions of the library, which allows an attacker to convince user to install a malicious extension to access local files via a crafted Chrome Extension...

Cross-site Scripting (XSS)

chromium is vulnerable to inappropriate implementation in Extensions, which allows an attacker to convince a user to install a malicious extension to inject scripts or HTML into a privileged page via a maliciously crafted Chrome Extension...

Insufficient Data Validation

chromium is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the insufficient data validation in Extensions, allowing an attacker to convince user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension...

Google Chrome Code Execution Vulnerability (CNVD-2023-63471)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that stems from a mal-execution issue in Extensions. An attacker could exploit this vulnerability to execute arbitrary code on a system or cause an application to crash...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome versions prior to 108.0.5359.71 due to an improper implementation in DevTools. An attacker can use this vulnerability to bypass file access restrictions to install malicious...

CVE-2023-37551

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfe...

CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4078

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

DEBIAN-CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Design/Logic Flaw

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4077

CVE-2023-4077 affects Google Chrome (and Chromium-derived browsers) via insufficient data validation in Extensions, allowing a user-driven attacker to inject scripts/HTML into a privileged page through a crafted Chrome Extension. The vulnerability is triggered when a user installs a malicious ext...

CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4078

The CVE-2023-4078 entry concerns Google Chrome/Chromium extensions. Insecure/crafted Extension handling before 115.0.5790.170 allowed an attacker to persuade a user to install a malicious extension, enabling script/HTML injection into a privileged page via the Extension. Impact is high (arising f...

CVE-2023-4078

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4078

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4078

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-4077

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...