CVE-2023-2725
Published: 16 May 2023
Summary
CVE-2023-2725 is a high-severity Use After Free (CWE-416) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-2725 is a use-after-free vulnerability in the Guest View component of Google Chrome versions prior to 113.0.5672.126. The flaw, assigned CWE-416, can result in heap corruption when triggered through a specially crafted HTML page and carries a CVSS 3.1 base score of 8.8.
An attacker who first persuades a victim to install a malicious extension can then supply the crafted page, enabling remote exploitation that may achieve arbitrary code execution with the privileges of the Chrome process. User interaction is required, but no additional privileges are needed beyond the initial extension installation.
Chrome stable-channel updates released on 16 May 2023 address the issue, and downstream distributions such as Fedora and Gentoo have published corresponding package advisories that recommend upgrading to the fixed Chrome version.
EPSS scores for the CVE have remained low, reaching a peak of 0.1127 in December 2025 before receding to the current value of 0.0890.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34189
Vulnerability details
Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.