CVE-2023-4762: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A type confusion bug in Chrome's V8 engine allowed attackers to run malicious code by tricking the browser into misidentifying data types. This could let criminals take control of your computer through a specially crafted webpage.
Type confusion vulnerability in V8 allows remote code execution when an attacker provides a crafted HTML page that causes the engine to misinterpret object types, bypassing type safety mechanisms. Exploitation requires user interaction (visiting a malicious page) but results in arbitrary code execution with browser privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.