Permissions, Privileges, and Access Controls in Google Chromium - CVE-2023-1228
Published: March 7, 2023 / Updated: March 8, 2023
Vulnerability identifier: #VU73133
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-1228
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient policy enforcement in Intents in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.
Affected software
Google Chromium
Microsoft Edge
Google Chrome
Debian Linux
chromium (Debian package)
Microsoft Edge
Google Chrome
Debian Linux
chromium (Debian package)
How to mitigate CVE-2023-1228
Update to version 111.0.5563.64.
Google Chromium - update to 111.0.5563.64
Microsoft Edge - addressed in versions 110.0.1587.69, 111.0.1661.41
Google Chrome - update to 111.0.5563.64
chromium (Debian package) - update to 111.0.5563.64-1~deb11u1
Microsoft Edge - addressed in versions 110.0.1587.69, 111.0.1661.41
Google Chrome - update to 111.0.5563.64
chromium (Debian package) - update to 111.0.5563.64-1~deb11u1