CVE-2023-1823

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Google	Chrome	>= 112.0.5615.49, < 112.0.5615.49

References

https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1406900Issue Tracking, Permissions Required, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/Mailing List
https://security.gentoo.org/glsa/202309-17Third Party Advisory
https://www.debian.org/security/2023/dsa-5386Third Party Advisory
https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/1406900Issue Tracking, Permissions Required, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/Mailing List
https://security.gentoo.org/glsa/202309-17Third Party Advisory
https://www.debian.org/security/2023/dsa-5386Third Party Advisory

Timeline

Published: Apr 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-18254.3An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before CVE-2023-18269.8A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown CVE-2023-18279.8A vulnerability has been found in SourceCodester Centralized Covid Vaccination Records System 1.0 and classified as critical. This vulnerabi CVE-2023-18297.8A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escala CVE-2023-18317.5Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the expe CVE-2023-18328.1An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result i CVE-2023-18339.8Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue CVE-2023-18349.1Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have CVE-2023-18356.1The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, CVE-2023-18365.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting fro CVE-2023-18378.8Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue aff CVE-2023-18387.1A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a