CVE-2023-2723
Published: 16 May 2023
Summary
CVE-2023-2723 is a high-severity Use After Free (CWE-416) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-2723 is a use-after-free vulnerability in the DevTools component of Google Chrome versions prior to 113.0.5672.126. The flaw, tracked under CWE-416, can result in heap corruption when triggered and carries a CVSS 3.1 base score of 8.8.
A remote attacker who has already compromised the renderer process can exploit the issue by serving a crafted HTML page, potentially achieving further memory corruption that affects confidentiality, integrity, and availability.
Chrome stable channel updates and downstream advisories from Fedora and Gentoo direct users to upgrade to version 113.0.5672.126 or later to address the flaw. The associated EPSS score reached a peak of 0.1646 after disclosure before settling at the current value of 0.1042, indicating a measurable increase in exploitation interest following public release.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34187
Vulnerability details
Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.