CVE-2023-4369

HighCVSS 8.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to version 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page.

Risk Assessment

The organization may be exposed to attacks that exploit malicious extensions to gain access to user files, potentially leading to data leaks.

Recommendation

It is recommended to update Google Chrome to the latest version and monitor installed extensions for potentially malicious applications.

Other vulnerabilities in Google Chrome on ChromeOS

CVE-2023-3731High
Use after free in Diagnostics in Google Chrome on ChromeOS prior to version 115.0.5790.131 allows an attacker who convinces a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.

Original NVD description (English source)

Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page. (Chromium security severity: Medium)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS