Log in Start free

Vulnerability · Published Feb 11, 2026 · Assigned by Hackrate

CVE-2026-2345Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers

Low 3.6

In plain English

A low-severity security flaw in Secure Exam Proctor Extension from Proctorio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)<0.1%top 99.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

Affected products (as reported)

VendorProductVersions
Proctorio Secure Exam Proctor Extension 1.5.25220.33

Weakness: CWE-346 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References