Cyber Resilience

CVE-2023-4428

High

Published: 23 August 2023

Published
23 August 2023
Modified
01 July 2025
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS Score 0.0953 93.0th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-4428 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability is an out-of-bounds memory access flaw in the CSS implementation of Google Chrome versions prior to 116.0.5845.110. It is tracked as CWE-125 and rated high severity by Chromium, with a CVSS 3.1 score of 8.1 reflecting network attack vector, low complexity, and impacts to confidentiality and availability.

A remote attacker can exploit the issue by serving a crafted HTML page to a victim; successful exploitation requires user interaction such as visiting the page in an affected browser and can result in an out-of-bounds memory read that discloses sensitive process memory or causes a denial of service.

Chrome desktop stable release notes and corresponding Fedora package advisories state that the flaw is resolved by upgrading to Chrome 116.0.5845.110 or later; the referenced Chromium bug report provides additional technical detail for patch verification.

The associated EPSS score reached a peak of 0.1093 before receding to the current value of 0.0953.

EU & UK References

Vulnerability details

Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

google
chrome
≤ 116.0.5845.110
fedoraproject
fedora
37, 38, 39
debian
debian linux
11.0, 12.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References