CVE-2023-5859

MEDIUM

Google Chrome < 119.0.6045.105 - Origin Validation Error

Title source: rule

Description

Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local HTML page. (Chromium security severity: Low)

References (9)

[Release Notes, Vendor Advisory] https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html

[Permissions Required] https://crbug.com/1482045

[Mailing List] https://lists.fedoraproject.org/archives/list/[email protected]/message/2MHLJRFWZNY6BFOW25Q4FEESVWZKS4C2/

[Mailing List] https://lists.fedoraproject.org/archives/list/[email protected]/message/EBA4KD5ZSV6XWWFLVR5UBYKKNOYMH33H/

[Mailing List] https://lists.fedoraproject.org/archives/list/[email protected]/message/PHWLT3M2AQDFD7RNAM3NJMYUC5KHMO5V/

[Third Party Advisory] https://security.gentoo.org/glsa/202311-11

[Third Party Advisory] https://security.gentoo.org/glsa/202312-07

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5546

[Third Party Advisory] https://security.gentoo.org/glsa/202401-34

Scores

CVSS v3 4.3

EPSS 0.0067

EPSS Percentile 71.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE

CWE-346

Status published

Products (6)

debian/debian_linux 11.0

debian/debian_linux 12.0

fedoraproject/fedora 37

fedoraproject/fedora 38

fedoraproject/fedora 39

google/chrome < 119.0.6045.105

Published Nov 01, 2023

Tracked Since Feb 18, 2026