VulnerabilityModified
CVE-2013-0924
The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.
HIGH 7.5EPSS 1.14%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- google/chrome
- Source
- chrome-cve-admin@google.com
References
- http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html
- https://code.google.com/p/chromium/issues/detail?id=169632
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16674
- http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html
- https://code.google.com/p/chromium/issues/detail?id=169632
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16674
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.