« Volver al listado

CVE-2026-2345

Estado: AplazadaBaja (3.6)—

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Proctorio — Chrome ExtensionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2345",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2345",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-11T21:19:02.758590Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.6,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "affectedData": [
        {
          "vendor": "Proctorio",
          "product": "Secure Exam Proctor Extension",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.25220.33"
            },
            {
              "status": "unaffected",
              "version": "1.5.25220.36"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-11T15:16:18.160",
  "references": [
    {
      "url": "https://www.hckrt.com/hacktivity/46b61f36-b685-4667-aebf-82a67ad69ad6",
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute."
    },
    {
      "lang": "es",
      "value": "La extensión de Chrome de Proctorio es una extensión de navegador utilizada para la supervisión en línea. La extensión contiene múltiples manejadores window.addEventListener('message', ...) que no validan correctamente el origen de los mensajes entrantes. Específicamente, un puente de mensajería interno procesa los mensajes basándose únicamente en la presencia de una propiedad fromWebsite sin verificar el atributo event.origin."
    }
  ],
  "lastModified": "2026-06-17T10:30:49.080",
  "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e"
}