CVE-2023-4077
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Risk Assessment
An attacker could exploit this vulnerability to gain control over privileged pages, potentially leading to data theft or other unauthorized access.
Recommendation
It is recommended to update Google Chrome to version 115.0.5790.170 or later to mitigate this vulnerability.
Other vulnerabilities in Google Chrome Extensions
See all- CVE-2026-8587High
A use after free vulnerability in Extensions in Google Chrome on Mac prior to version 148.0.7778.168 allows an attacker to execute arbitrary code via a malicious extension if a user installs it.
- CVE-2016-1648High
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2026-12467High
Use after free in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-12457Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2026-12456Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
- CVE-2026-12445High
A use after free vulnerability in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker to exploit heap corruption via a malicious extension if a user installed it.
- CVE-2026-12017Low
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2023-4366High
Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-4078High
Inappropriate implementation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Original NVD description (English source)
Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)