CVE-2023-28286: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-28286 is a remote code execution vulnerability in Microsoft Edge (Chromium-based), rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.1 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.58% probability of exploitation activity in the next 30 days, higher than 48% of all scored vulnerabilities. Microsoft released the fix on 24 March 2023, outside Patch Tuesday. It affects 2 products in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2023-28286
- Severity
- Medium CVSS 6.1
- Microsoft severity
- Moderate
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-693
- EPSS
- 0.58% (percentile 48%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- March 2023 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2023-28286 at 6.1 (temporal 5.3) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality impact | Low |
| Integrity impact | Low |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?
The attacker is only able to modify the content of the vulnerable link to redirect the victim to a malicious site.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted URL to be compromised by the attacker.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.
According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L)? What does that mean for this vulnerability?
Limited information from the victim's browser associated with the vulnerable URL can be sent to the attacker by the malicious code.
What is the version information for this release?
Microsoft Edge Channel
Microsoft Edge Version
Based on Chromium Version
Date Released
Stable
111.0.1661.54
111.0.5563.110/.111
3/23/2023
Extended Stable
110.0.1587.78
110.0.5481.208
3/23/2023
Affected products (2)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Edge (Chromium-based) | Release Notes | Security Update | 111.0.1661.54 | No |
| Microsoft Edge (Chromium-based) Extended Stable | Release Notes | Security Update | 110.0.1587.78 | No |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 6.1 (MEDIUM)
- NVD weakness
- CWE-693
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| edge chromium | before 110.0.1587.78 |
| edge chromium | before 111.0.1661.54 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28286 (Patch, Vendor Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28286 (Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/202309-17 (Third Party Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |