CVE-2023-4368

HighCVSS 8.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.

Risk Assessment

Organizations may be at risk if users install malicious extensions, potentially leading to security policy violations and data leaks.

Recommendation

It is recommended to update Google Chrome to the latest version and implement strict policies regarding user installation of extensions.

Other vulnerabilities in Google Chrome Extensions API

CVE-2023-4367Medium
Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.

Original NVD description (English source)

Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS