CVE-2023-1817
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49...
6.5 MediumFix available
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
0.97%Up 0.9 points since Apr 5, 2023
What each source reports
NVD Score used
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
CVE-2023-1817- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
CVE List No score
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
CVE-2023-1817- Updated
- 2026-11-02
EUVDEUVD-2023-24019
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
EUVD-2023-24019- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc76-fw57-4g3c
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49...
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
GHSA-gc76-fw57-4g3c- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
CVE-2023-1817- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-1817
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Record
DEBIAN-CVE-2023-1817- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0092-1 No score
Security update for chromium
This update for chromium fixes the following issues:
-
Chromium 112.0.5615.121:
- CVE-2023-2033: Type Confusion in V8 (boo#1210478)
-
Chromium 112.0.5615.49
- CSS now supports nesting rules.
- The algorithm to set the initial focus on <dialog> elements was updated.
- No-op fetch() handlers on service workers are skipped from now on to make navigations faster
- The setter for document.domain is now deprecated.
- The recorder in devtools can now record with pierce selectors.
- Security fixes (boo#1210126):
- CVE-2023-1810: Heap buffer overflow in Visuals
- CVE-2023-1811: Use after free in Frames
- CVE-2023-1812: Out of bounds memory access in DOM Bindings
- CVE-2023-1813: Inappropriate implementation in Extensions
- CVE-2023-1814: Insufficient validation of untrusted input in Safe Browsing
- CVE-2023-1815: Use after free in Networking APIs
- CVE-2023-1816: Incorrect security UI in Picture In Picture
- CVE-2023-1817: Insufficient policy enforcement in Intents
- CVE-2023-1818: Use after free in Vulkan
- CVE-2023-1819: Out of bounds read in Accessibility
- CVE-2023-1820: Heap buffer overflow in Browser History
- CVE-2023-1821: Inappropriate implementation in WebShare
- CVE-2023-1822: Incorrect security UI in Navigation
- CVE-2023-1823: Inappropriate implementation in FedCM
-
Chromium 111.0.5563.147:
- nth-child() validation performance regression for SAP apps
- Record
openSUSE-SU-2023:0092-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12844-1 No score
chromedriver-112.0.5615.49-1.1 on GA media
These are all security issues fixed in the chromedriver-112.0.5615.49-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12844-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 112.0.5615.49-1 | 112.0.5615.49-1 |
chromiumDebian:13 |
before 112.0.5615.49-1 | 112.0.5615.49-1 |
chromiumDebian:14 |
before 112.0.5615.49-1 | 112.0.5615.49-1 |
chromiumDebian:11 From an advisory covering 16 CVEs |
before 112.0.5615.49-2~deb11u2, plus listed versions 100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1 Show 45 moreShow less100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1 |
112.0.5615.49-2~deb11u2 |
chromiumSUSE:Package Hub 15 SP4 From an advisory covering 15 CVEs |
before 112.0.5615.121-bp154.2.79.1 | 112.0.5615.121-bp154.2.79.1 |
chromiumopenSUSE:Leap 15.4 From an advisory covering 15 CVEs |
before 112.0.5615.121-bp154.2.79.1 | 112.0.5615.121-bp154.2.79.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 112.0.5615.49-1.1 | 112.0.5615.49-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-1817 is a medium vulnerability (CVSS 6.5) in Google Chrome, published April 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in chromium 112.0.5615.49-1.
References
chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html
crbug.com/1418061
lists.fedoraproject.org/archives/list/[email protected]/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX
debian.org/security/2023/dsa-5386
security.gentoo.org/glsa/202309-17
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-1817
github.com/advisories/GHSA-gc76-fw57-4g3c
security-tracker.debian.org/tracker/CVE-2023-1817
lists.opensuse.org/archives/list/[email protected]/thread/BRCY3MMGSLE74IM7LN5E42APXAOQ5ZQG
bugzilla.suse.com/1210126
suse.com/security/cve/CVE-2023-1810
This page doesn't list everything
Left out here: 43 versions and 2,122 references. The JSON record has them.