CVE-2023-4428
Published: 23 August 2023
Summary
CVE-2023-4428 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an out-of-bounds memory access flaw in the CSS implementation of Google Chrome versions prior to 116.0.5845.110. It is tracked as CWE-125 and rated high severity by Chromium, with a CVSS 3.1 score of 8.1 reflecting network attack vector, low complexity, and impacts to confidentiality and availability.
A remote attacker can exploit the issue by serving a crafted HTML page to a victim; successful exploitation requires user interaction such as visiting the page in an affected browser and can result in an out-of-bounds memory read that discloses sensitive process memory or causes a denial of service.
Chrome desktop stable release notes and corresponding Fedora package advisories state that the flaw is resolved by upgrading to Chrome 116.0.5845.110 or later; the referenced Chromium bug report provides additional technical detail for patch verification.
The associated EPSS score reached a peak of 0.1093 before receding to the current value of 0.0953.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54290
Vulnerability details
Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.