Race condition in Microsoft Edge - CVE-2023-28261

Vulnerability identifier: #VU74029

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28261

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. A local user can exploit the race and gain unauthorized access to sensitive information and execute arbitrary code with SYSTEM privileges.

Microsoft Edge
Gentoo Linux
www-client/microsoft-edge
www-client/chromium
www-client/chromium-bin
www-client/google-chrome

Install updates from vendor's website.

Microsoft Edge - addressed in versions 110.0.1587.78, 111.0.1661.54
www-client/microsoft-edge - update to 113.0.1774.50
www-client/chromium - update to 113.0.5672.126
www-client/chromium-bin - update to 113.0.5672.126
www-client/google-chrome - update to 113.0.5672.126

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-28261

• Multiple vulnerabilities in Microsoft Edge
• Gentoo update for Chromium, Google Chrome, Microsoft Edge