CVE-2023-2940

Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)

• CWE-284

• https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.htmlRelease Notes, Vendor Advisory
• https://crbug.com/1426807Permissions Required
• https://security.gentoo.org/glsa/202311-11
• https://security.gentoo.org/glsa/202401-34
• https://www.debian.org/security/2023/dsa-5418
• https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.htmlRelease Notes, Vendor Advisory
• https://crbug.com/1426807Permissions Required
• https://security.gentoo.org/glsa/202311-11
• https://security.gentoo.org/glsa/202401-34
• https://www.debian.org/security/2023/dsa-5418

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29385Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-29386Unrestricted Upload of File with Dangerous Type vulnerabilit…9.1
• CVE-2023-29387Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-29388Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-29389Toyota RAV4 2021 vehicles automatically trust messages from …6.8
• CVE-2023-2939Insufficient data validation in Installer in Google Chrome o…7.8
• CVE-2023-29400Templates containing actions in unquoted HTML attributes (e.…7.3
• CVE-2023-29401The filename parameter of the Context.FileAttachment functio…4.3
• CVE-2023-29402The go command may generate unexpected code at build time wh…9.8
• CVE-2023-29403On Unix platforms, the Go runtime does not behave differentl…7.8
• CVE-2023-29404The go command may execute arbitrary code at build time when…9.8
• CVE-2023-29405The go command may execute arbitrary code at build time when…9.8