CVE-2026-2345CWE-346

Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers

Low · published February 11, 2026

CVSS v3.1
3.6
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00077 · 0.1th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-02-11T14:49Z
EPSS history
Timeline
  • 11 FEB 14:49Z
    Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers
    cvelistv5