VulnerabilityDeferred

CVE-2026-2345

Proctorio Chrome Extension is a browser extension used for online proctoring.

LOW 3.6EPSS 0.07%

Does this matter?

Lower severity and a low EPSS score (0.07%). Track it; it rarely justifies an emergency change on its own.

Description

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

CVSS 3.1: 3.6 LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 0.07% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-346
Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e

References

https://www.hckrt.com/hacktivity/46b61f36-b685-4667-aebf-82a67ad69ad6

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.