CVE-2023-3079

Summary

CVE	CVE-2023-3079
State	PUBLISHED
Assigner	Chrome
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-06-05 22:15:12 UTC
Updated	2026-10-08 18:04:20 UTC
Description	Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.378580000 probability, percentile 0.985490000 (date 2026-10-24)

CISA KEV: Listed on 2023-06-07; due 2023-06-28; ransomware use Unknown

Problem Types: CWE-843 | Type Confusion | CWE-843 CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
3.1	ADP	DECLARED	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Vendor	Google
Product	Chromium V8
Name	Google Chromium V8 Type Confusion Vulnerability
Required Action	Apply updates per vendor instructions.
Notes	https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2023-3079

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Couchbase	Couchbase Server	All	All	All	All
Application	Couchbase	Couchbase Server	7.2.0	All	All	All
Operating System	Debian	Debian Linux	11.0	All	All	All
Operating System	Debian	Debian Linux	12.0	All	All	All
Operating System	Fedoraproject	Fedora	37	All	All	All
Operating System	Fedoraproject	Fedora	38	All	All	All
Application	Google	Chrome	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Google	Chrome	affected 114.0.5735.110 114.0.5735.110 custom	Not specified

References

Reference	Source	Link	Tags
Enterprise Security Alerts & Advisories for Couchbase	af854a3a-2127-422b-91ae-364da2661108	www.couchbase.com	Third Party Advisory
QtWebEngine: Multiple Vulnerabilities (GLSA 202311-11) — Gentoo security	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org	Third Party Advisory
Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities (GLSA 202401-34) — Gentoo security	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org	Third Party Advisory
1450481 - chromium - An open-source project to help move the web forward. - Monorail	af854a3a-2127-422b-91ae-364da2661108	crbug.com	Exploit, Issue Tracking
[SECURITY] Fedora 37 Update: chromium-114.0.5735.106-1.fc37 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List, Third Party Advisory
[SECURITY] Fedora 38 Update: chromium-114.0.5735.106-1.fc38 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org	Mailing List, Third Party Advisory
Chrome V8 Type Confusion ≈ Packet Storm	af854a3a-2127-422b-91ae-364da2661108	packetstormsecurity.com	Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog	134c704f-9b21-4f2e-91b3-4a467353bcc0	www.cisa.gov	US Government Resource
Debian -- Security Information -- DSA-5420-1 chromium	af854a3a-2127-422b-91ae-364da2661108	www.debian.org	Mailing List, Third Party Advisory
Chrome Releases: Stable Channel Update for Desktop	af854a3a-2127-422b-91ae-364da2661108	chromereleases.googleblog.com	Vendor Advisory
Chrome V8 Type Confusion / New Sandbox Escape ≈ Packet Storm	af854a3a-2127-422b-91ae-364da2661108	packetstormsecurity.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
ADP	2023-06-07T00:00:00.000Z	CVE-2023-3079 added to CISA KEV

Legacy QID Mappings

181832 Debian Security Update for chromium (DSA 5420-1)
284034 Fedora Security Update for chromium (FEDORA-2023-f4954af225)
284062 Fedora Security Update for chromium (FEDORA-2023-6fe7ff3452)
378549 Google Chrome Prior to 114.0.5735.106 for Linux and Mac and 114.0.5735.110 for Windows Multiple Vulnerabilities
378557 Microsoft Edge Based on Chromium Prior to 114.0.1823.41 Multiple Vulnerabilities
378588 Microsoft Edge Based on Chromium Prior to 109.0.1518.115 Multiple Vulnerabilities
503241 Alpine Linux Security Update for qt5-qtwebengine
506198 Alpine Linux Security Update for qt5-qtwebengine
691182 Free Berkeley Software Distribution (FreeBSD) Security Update for chromium (12741b1f-04f9-11ee-8290-a8a1599412c6)
691191 Free Berkeley Software Distribution (FreeBSD) Security Update for electron24 (aae2ab45-2d21-4cd5-a53b-07ec933400ac)
691192 Free Berkeley Software Distribution (FreeBSD) Security Update for electron22 (3c3d3dcb-bef7-4d20-9580-b4216b5ff6a2)
691193 Free Berkeley Software Distribution (FreeBSD) Security Update for electron23 (3bf6795c-d44c-4033-9b37-ed2e30f34fca)
710797 Gentoo Linux QtWebEngine Multiple Vulnerabilities (GLSA 202311-11)
710849 Gentoo Linux Chromium, Google Chrome, Microsoft Edge Multiple Vulnerabilities (GLSA 202401-34)