Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2023-2467: Chrome for Android before 113.0.5672.63 can skip permission checks
CVE-2023-2467 · published 3 years ago
Summary
The Android version of Chrome (as used in Debian's Chromium package) released before version 113.0.5672.63 can be fooled by a specially crafted web page to ignore its normal permission checks. This could let a malicious site gain access to features that should be blocked, such as location or camera. Update Chrome to version 113.0.5672.63 or later to restore proper permission protection.
What to do
- Update debian chromium to version 113.0.5672.63-1.
- Update google chrome to version 113.0.5672.63 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 113.0.5672.63-1 Fix: upgrade to 113.0.5672.63-1
|
| Debian:13 | debian | chromium |
< 113.0.5672.63-1 Fix: upgrade to 113.0.5672.63-1
|
| Debian:14 | debian | chromium |
< 113.0.5672.63-1 Fix: upgrade to 113.0.5672.63-1
|
| – | chrome |
< 113.0.5672.63 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | fedoraproject | fedora |
36 37 38 cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
| – | debian | debian_linux |
11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
Original advisory text
Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security s...
Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low)
References
- https://security-tracker.debian.org/tracker/CVE-2023-2467 Vendor Advisory
- https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.... Release Notes
- https://crbug.com/1413586 Issue Tracking Permissions Required
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]... Mailing List
- https://security.gentoo.org/glsa/202309-17 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5398 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.3
Medium
Timeline
Published3 May 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta