#VU7960 Backdoor in Infinity New Tab (Chrome extension)
Published: August 16, 2017 / Updated: November 22, 2018
Vulnerability identifier: #VU7960
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: N/A
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Infinity New Tab (Chrome extension)
Infinity New Tab (Chrome extension)
Software vendor:
Starlab Tech
Starlab Tech
Description
The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.
The vulnerability exists due to presence of backdoor code in Infinity New Tab Google Chrome extension 3.12.3, distributed via Google Web Store.
The vulnerability exists due to presence of backdoor code in Infinity New Tab Google Chrome extension 3.12.3, distributed via Google Web Store.
Remediation
Update to version 6.0.0 or later.