CVE-2023-7012
published 2024-07-16CVE-2023-7012: Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app…
PriorityP346critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.32%
24.0th percentile
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 117.0.5938.62-1~deb11u1 | 117.0.5938.62-1~deb11u1 |
| chromium | chromium | >= 0 < 117.0.5938.62-1~deb12u1 | 117.0.5938.62-1~deb12u1 |
| chromium | chromium | >= 0 < 117.0.5938.62-1 | 117.0.5938.62-1 |
| chromium | chromium | >= 0 < 117.0.5938.62-1 | 117.0.5938.62-1 |
| debian | chromium | < chromium 117.0.5938.62-1~deb12u1 (bookworm) | chromium 117.0.5938.62-1~deb12u1 (bookworm) |
| chrome | < 117.0.5938.62 | 117.0.5938.62 | |
| chrome | >= 117.0.5938.62 < 117.0.5938.62 | 117.0.5938.62 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv9.6CRITICAL
vendor_debian9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2023-7012
vendor_chrome·2023-09-12·CVSS 4.3
CVE-2023-7012 [MEDIUM] Stable Channel Update for Desktop: CVE-2023-7012
Stable Channel Update for Desktop
CVE-2023-7012: Insufficient data validation in Permission Prompts. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2022-10-28 [$6000][ 1449874 ] Low CVE-2023-4906: Insufficient policy enforcement in Autofill
Reported by Ahmed ElMasry on 2023-05-30 [$2000][ 1462104 ] Low CVE-2023-4907: Inappropriate implementation in Intents
Severity: medium
Debian
CVE-2023-7012: chromium - Insufficient data validation in Permission Prompts in Google Chrome prior to 117...
vendor_debian·2023·CVSS 9.6
CVE-2023-7012 [CRITICAL] CVE-2023-7012: chromium - Insufficient data validation in Permission Prompts in Google Chrome prior to 117...
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
Scope: local
bookworm: resolved (fixed in 117.0.5938.62-1~deb12u1)
bullseye: resolved (fixed in 117.0.5938.62-1~deb11u1)
forky: resolved (fixed in 117.0.5938.62-1)
sid: resolved (fixed in 117.0.5938.62-1)
trixie: resolved (fixed in 117.0.5938.62-1)
GHSA
GHSA-c369-vvw4-mwwv: Insufficient data validation in Permission Prompts in Google Chrome prior to 117
ghsa_unreviewed·2024-07-17
CVE-2023-7012 [HIGH] CWE-138 GHSA-c369-vvw4-mwwv: Insufficient data validation in Permission Prompts in Google Chrome prior to 117
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
OSV
CVE-2023-7012: Insufficient data validation in Permission Prompts in Google Chrome prior to 117
osv·2024-07-16·CVSS 9.6
CVE-2023-7012 [CRITICAL] CVE-2023-7012: Insufficient data validation in Permission Prompts in Google Chrome prior to 117
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
2024-07-16
Published