First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-2345

LowCVSS 3.6/10Last modified Jun 17, 2026

Description

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Proctorio	Secure Exam Proctor Extension	1.5.25220.33

References

https://www.hckrt.com/hacktivity/46b61f36-b685-4667-aebf-82a67ad69ad6

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-234509.8In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzka CVE-2026-234517.5In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infinite loop in bond_header_parse() bond_h CVE-2026-234524.7In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The follow CVE-2026-234537.5In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mo CVE-2026-234547.0In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reorderi CVE-2026-234559.1In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In CVE-2026-234568.2In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case I CVE-2026-234578.6In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_h CVE-2026-234587.8In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ct CVE-2026-234598.2In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blam CVE-2026-23469.8Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This i CVE-2026-234605.5In the Linux kernel, the following vulnerability has been resolved: net/rose: fix NULL pointer dereference in rose_transmit_link on reconne

CVE-2026-2345: Low severity, CVSS 3.6 | Vulnix