CVE-2023-7012 is a critical (CVSS 9.6) insufficient data validation flaw in Permission Prompts in Google Chrome before 117.0.5938.62, though Chromium rates it Medium. It could allow a sandbox escape if a user installs a malicious app. Update Chrome to 117.0.5938.62 or later.
What's affected
The record says Google Chrome prior to 117.0.5938.62 is affected. Google's Stable Channel Update of 12 September 2023 promotes Chrome 117 and lists this issue as Medium, CVE-2023-7012, insufficient data validation in Permission Prompts. The CVSS score in the record is 9.6, which is Critical, and the Chromium severity is Medium. Both are stated here because they differ.
The description needs a user to be convinced to install a malicious app before the sandbox escape is possible, which is why Chromium's rating is lower than the CVSS number suggests.
How to check if you're exposed
Open chrome://version in the browser, or run the command line for your platform.
google-chrome --version # Linux
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version # macOS
On Windows, use Settings, About Chrome. The fixed build per Google's release notes is 117.0.5938.62 for Linux and Mac and 117.0.5938.62 or .63 for Windows. Also check other Chromium-based browsers and embedded runtimes such as Electron apps, which update on their own schedule.
What to do now
- Update Chrome to a current stable release. Anything at or above 117.0.5938.62 includes this fix.
- Relaunch the browser after updating, since the update applies on restart.
- Check managed fleets for browsers pinned to old versions.
- Update other Chromium-based browsers and Electron-based apps from their vendors.
Why it matters
The description says insufficient data validation in the permission prompt code allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape through a malicious file. The record tags CWE-20 and CWE-138. A sandbox escape matters because the sandbox is what limits the damage from a compromised web page.
The gap between Critical and Medium is worth understanding. CVSS scores the worst case of the impact, while Chromium weighs how hard the bug is to reach. For a patching decision both point the same way: update the browser, which is a cheap and routine action.
Browsers are the most exposed software on most desktops, and they update on their own when allowed. Set a maximum age for browser versions, enforce it with device management, and treat managed machines that block updates as the real gap.
Weakness class in the record: CWE-20 (Improper Input Validation) CWE-138 (Improper Neutralization of Special Elements).
Quick check
Which rating should drive my patching?
Neither alone. Browser updates are low cost, so apply them promptly. Use the rating differences to understand the conditions for exploitation, not to delay.
How fast should browser updates reach our fleet?
Within days. Auto-update makes this cheap. Set a policy for the maximum age of a browser version and enforce it through device management.
Sources
Last reviewed: 19 October 2026.
