CVE-2023-4357: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Google Chrome had a flaw where it didn't properly check XML data from websites, allowing attackers to bypass protections that prevent websites from accessing your files. A hacker could create a malicious webpage that tricks your browser into accessing files it shouldn't.
Insufficient input validation in XML processing allowed remote attackers to bypass file access restrictions through a crafted HTML page. The vulnerability exists in Chrome versions prior to 116.0.5845.96 and requires user interaction (opening a malicious page). The attack vector is network-based with low complexity, affecting the confidentiality of local file access.
In the same product, most dangerous first.