CVE-2023-21794: Microsoft Edge (Chromium-based) Spoofing Vulnerability

Overview

Severity

Medium (CVSS 4.3)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

Category

Edge - Chromium

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2023-Feb

Released

2023-02-09

EPSS Score

0.64% (percentile: 70.5%)

FAQ

According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability? The user would need to access the URL of the malicious website, which could spoof the content of a legitimate website, and then click a popup displayed on that site. What is the version information for this release? Microsoft Edge Version Date Released Based on Chromium Version 110.0.1587.41 2/9/2023 110.0.5481.78 According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker.

Affected Products (1)

Browser

• Microsoft Edge (Chromium-based)

Acknowledgments

Anonymous

Revision History

• 2023-02-09: Information published.