CVE-2023-7024: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Google Chrome's WebRTC feature allows attackers to corrupt memory through a specially crafted webpage, potentially crashing your browser or enabling more serious attacks.
Heap buffer overflow in WebRTC component allows remote code execution or denial of service via crafted HTML. Attack requires user interaction (visiting malicious page); impacts memory integrity and sandbox bypass potential.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.