CVE-2026-2345
Low · 3.6CVSS
3.6
EPSS
0.1%
Published
Feb 11, 2026
CISA due date
—
The record
Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
- CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346
- CVE-2026-94485 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-94486 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity… CWE-346
- CVE-2026-87563 Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-346
- CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplication keys… CWE-346
- CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability… CWE-346