CVE-2023-0471

Published on: Not Yet Published

Last Modified on: 02/20/2023 09:28:57 AM UTC

CVE-2023-0471

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Chrome from Google contain the following vulnerability:

Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-0471 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
Affected Vendor/Software: Google - Chrome version < 109.0.5414.119

CVSS3 Score: 8.8 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	REQUIRED
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVE References

Description	Tags ^ⓘ	Link
cve-website	www.cve.org text/html	MISC www.cve.org/CVERecord?id=CVE-2023-0471
Chrome Releases: Stable Channel Update for Desktop	chromereleases.googleblog.com text/html	MISC chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html
1376354 - chromium - An open-source project to help move the web forward. - Monorail	crbug.com text/html	MISC crbug.com/1376354

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

181507 Debian Security Update for chromium (DSA 5328-1)
199185 Ubuntu Security Notification for Chromium Vulnerabilities (USN-5881-1)
283669 Fedora Security Update for chromium (FEDORA-2023-fd4786cc83)
377931 Google Chrome Prior to 109.0.5414.119 Multiple Vulnerabilities
377935 Microsoft Edge Based on Chromium Prior to 109.0.1518.70/ Extended Version 108.0.1462.95 has Multiple Vulnerabilities
691041 Free Berkeley Software Distribution (FreeBSD) Security Update for chromium (3d0a3eb0-9ca3-11ed-a925-3065ec8fd3ec)
753675 OpenSUSE Security Update for opera (openSUSE-SU-2023:0044-1)

Exploit/POC from Github

Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially expl…

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Google	Chrome	All	All	All	All

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@RedPacketSec	Google Chrome code execution \| CVE-2023-0471 - redpacketsecurity.com/google-chrome-… #CVE #Vulnerability #OSINT #ThreatIntel #Cyber	2023-01-25 10:01:37
@SalgueiroMiguel	Las vulnerabilidades de RCE: • CVE-2023-0471, Gravedad alta: se usa después de una vulnerabilidad gratuita en WebT… twitter.com/i/web/status/1…	2023-01-25 15:25:57
@zpring	@cassidy6564 - reporter here.. do you have a minute to breakdown CVE-2023-0471? please D/M me, if you can/want. ?	2023-01-25 17:49:42
@MachinaRecord	?Chrome 109のセキュリティアップデートで脆弱性6件が修正される（CVE-2023-0471、CVE-2023-0472ほか） ?Azure AD Kerberosで行われ得るラテラルムーブメントの緩和策が編み出される… twitter.com/i/web/status/1…	2023-01-26 08:43:55
/r/k12cybersecurity	MS-ISAC CYBERSECURITY ADVISORY – Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution – PATCH: NOW	2023-01-25 13:44:05