What’s Vulnerable › Vulnerabilities
CVE-2026-2345: Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers
- Severity: low (CVSS 3.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-11 · updated 2026-06-17
- Weakness: CWE-346
Description
Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.
Affected products
- Proctorio Secure Exam Proctor Extension: 1.5.25220.33
References
Get alerted when CVE-2026-2345 or the next vulnerability affects your stack