CVE-2023-4357: Chrome XML input validation flaw bypasses file access restrictions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with high EPSS and no authentication requirement, but exploitation requires user interaction and no KEV or public exploit evidence is present.

What it is

Google Chrome before 116.0.5845.96 fails to sufficiently validate untrusted XML input, letting a crafted HTML page bypass file access restrictions. The flaw is rated Chromium security severity Medium but scores 8.8 under CVSS 3.1, so the practical risk is higher than the vendor label suggests.

Impact

An attacker can bypass file access restrictions in the browser, potentially reading or acting on resources the page should not reach. The CVSS vector indicates high confidentiality, integrity and availability impact, though the record does not detail the exact end effect.

Attack surface

Reached over the network via a crafted HTML page rendered in Chrome; the vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed, but the victim must open or be lured to the page.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is high at 0.47122 (98.78th percentile), and references are vendor advisories and distro notices rather than public exploit tags.

What to do

• Update Chrome to 116.0.5845.96 or later, and apply the corresponding Debian DSA-5479, Fedora and Gentoo updates for bundled Chromium.
• Enforce automatic browser updates and verify version compliance across managed endpoints.
• Restrict or sandbox browser access to local file resources where policy allows.
• Block or warn on untrusted HTML/XML content delivered from external sources.
• Monitor vendor advisories for follow-up fixes to the same XML handling code.

Detection

• Alert on Chrome or Chromium versions below 116.0.5845.96 in endpoint inventory.
• Hunt for browser processes accessing local files outside expected user-initiated paths.
• Review proxy and DNS logs for delivery of crafted HTML pages to browsers on unpatched hosts.
• Correlate suspicious browser file access with recent page loads from untrusted origins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.