CVE-2023-7261
Google Updater ≤ 1.3.36.351
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-7261 is a high-severity Improper Handling of Parameters (CWE-233) vulnerability in Google Updater. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59655
Vulnerability Data
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validity checks on information inputs, directly stopping missing or undefined parameters from being accepted.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and correct parameter handling to avoid this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure requirements, checkpoints, secure coding guidelines, testing, developer training) that reach improper parameter handling in the design/coding/testing phases, but leaves a bounded remainder (e.g. incomplete enforcement of guidelines, outsourced development without full assurance, or post-release parameter logic errors).
Application security requirements explicitly call for validation of inputs and parameters, mitigating missing or undefined arguments.
Secure coding standards directly address proper handling of function parameters and input validation.
Security testing can detect missing-parameter issues but does not prevent them at design time.