CVE-2011-1123 Missing authorization in n/a

High 7.5 Published 1 Mar 2011 Updated 6 Aug 2024

Attackers can bypass restrictions to access internal extension functions in Google Chrome, potentially compromising browser security.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2011-1123?

CVE-2011-1123 is a high-severity missing authorization vulnerability in Google Chrome, published on 1 Mar 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors.

Weakness: CWE-863

Which versions are affected by CVE-2011-1123?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2011-1123?

No fix has been published for CVE-2011-1123 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2011-1123 being exploited?

There is no known exploitation of CVE-2011-1123 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as GHSA-r2gp-2qvr-hpqm.