CVE-2023-2936
Published: 30 May 2023
Summary
CVE-2023-2936 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Type Confusion in the V8 JavaScript engine affected Google Chrome versions prior to 114.0.5735.90. The flaw, tracked as CWE-843, could be triggered by a specially crafted HTML page and result in heap corruption, carrying a CVSS 3.1 score of 8.8.
A remote attacker could exploit the issue by persuading a user to visit a malicious web page, potentially gaining the ability to corrupt heap memory and achieve arbitrary code execution within the renderer process.
Chrome stable channel updates and Gentoo Linux security advisories GLSA-202311-11 and GLSA-202401-34 direct users to upgrade to version 114.0.5735.90 or later to address the vulnerability. Public references also include a proof-of-concept on Packet Storm and the upstream Chromium bug report.
The associated EPSS score reached a modest peak of 0.1049 before receding to its current value of 0.0926.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34382
Vulnerability details
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.