Every CVE Search/ Get API key

CVE-2023-2725

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who...

8.8 HighFix available

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

24.7%Up 24.6 points since May 17, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-2725
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CVE List 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-2725
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2023-34189 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
EUVD-2023-34189
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-c4fp-wmv9-q4cr 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who...

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
GHSA-c4fp-wmv9-q4cr
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-2725
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-2725 8.8

Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
DEBIAN-CVE-2023-2725
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2023:0114-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 99.0.4788.13

    • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
    • DNA-107317 __delayLoadHelper2 crash in crashreporter

  • The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

  • Update to 99.0.4788.9

    • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
    • DNA-107638 Translations for O99
    • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
    • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
    • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
    • DNA-107840 Promote O99 to stable

  • Update to 98.0.4759.39

    • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
    • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
    • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
    • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
    • DNA-107435 Building archive_source_release target fails
    • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
    • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
    • DNA-107528 Handle real-time SD impression reporting
    • DNA-107546 Context menus broken with one workspace
    • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
    • DNA-107560 Optimize real-time SD impression reporting

  • Update to 98.0.4759.15

    • CHR-9259 Update Chromium on desktop-stable-112-4759 to 112.0.5615.121
    • CHR-9264 Update Chromium on desktop-stable-112-4759 to 112.0.5615.165
    • DNA-104949 Cleanup reauthorizer and permission
    • DNA-106748 Presubmit problems
    • DNA-107262 Delete faulty translations

  • The update to chromium 112.0.5615.165 fixes following issues: CVE-2023-2133, CVE-2023-2134, CVE-2023-2135, CVE-2023-2136, CVE-2023-2137

  • Changes in 98.0.4759.6

    • CHR-9255 Update Chromium on desktop-stable-112-4759 to 112.0.5615.87
    • DNA-106342 Crash when blocking cookies in sidebar web.infobars::InfoBarManager::AddInfoBar(std::Cr::unique_ptr, bool)
    • DNA-107054 Apply patch for CVE-2023-2033
    • DNA-107141 Promote O98 to stable
    • DNA-107142 Translations for O98

  • Update to 97.0.4719.83

    • DNA-106342 Crash when blocking cookies in sidebar web. infobars::InfoBarManager::AddInfoBar(std::Cr::unique_ptr, bool)
    • DNA-106550 [SD][Drag&Drop] Create a static manual layout for speed dials
    • DNA-106791 Run smoketests on mac arm builds
    • DNA-107054 Apply patch for CVE-2023-2033

  • Remove setup_repo.sh, fix non-executable-script rpmlint warning and we do not want create a repo

  • Update to 97.0.4719.63

    • CHR-9245 Update Chromium on desktop-stable-111-4719 to 111.0.5563.147
    • DNA-105919 Set new Baidu search string
    • DNA-106168 EasySetup update

  • Update to 97.0.4719.43

    • CHR-9236 Update Chromium on desktop-stable-111-4719 to 111.0.5563.111
    • DNA-105141 Tabs to the right of the currently active one swap their position with another when clicked
    • DNA-106044 Translations for O97
    • DNA-106300 Fix rule for generating archive_browser_sym_files on crossplatform builds
    • DNA-106412 Content of popup not generated for some extensions when using more then one worksapce
    • DNA-106433 Extend Easy Setup API
    • DNA-106435 Increase timeout for the welcome page
    • DNA-106453 Public build from desktop-stable-111-4719 do not compile

  • The update to chromium 111.0.5563.111 fixes following issues: CVE-2023-1528, CVE-2023-1529, CVE-2023-1530, CVE-2023-1531, CVE-2023-1532,…

Record
openSUSE-SU-2023:0114-1
Updated
2026-11-02
OSVopenSUSE-SU-2023:0115-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 99.0.4788.13

    • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
    • DNA-107317 __delayLoadHelper2 crash in crashreporter

  • The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

  • Update to 99.0.4788.9

    • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
    • DNA-107638 Translations for O99
    • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
    • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
    • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
    • DNA-107840 Promote O99 to stable

  • Update to 98.0.4759.39

    • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
    • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
    • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
    • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
    • DNA-107435 Building archive_source_release target fails
    • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
    • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
    • DNA-107528 Handle real-time SD impression reporting
    • DNA-107546 Context menus broken with one workspace
    • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
    • DNA-107560 Optimize real-time SD impression reporting
Record
openSUSE-SU-2023:0115-1
Updated
2026-11-02
OSVopenSUSE-SU-2023:0117-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • build with llvm15 on Leap

  • Chromium 113.0.5672.126 (boo#1211442):

    • CVE-2023-2721: Use after free in Navigation
    • CVE-2023-2722: Use after free in Autofill UI
    • CVE-2023-2723: Use after free in DevTools
    • CVE-2023-2724: Type Confusion in V8
    • CVE-2023-2725: Use after free in Guest View
    • CVE-2023-2726: Inappropriate implementation in WebApp Installs
    • Various fixes from internal audits, fuzzing and other initiatives

  • Chromium 113.0.5672.92 (boo#1211211)

  • Multiple security fixes (boo#1211036):

    • CVE-2023-2459: Inappropriate implementation in Prompts
    • CVE-2023-2460: Insufficient validation of untrusted input in Extensions
    • CVE-2023-2461: Use after free in OS Inputs
    • CVE-2023-2462: Inappropriate implementation in Prompts
    • CVE-2023-2463: Inappropriate implementation in Full Screen Mode
    • CVE-2023-2464: Inappropriate implementation in PictureInPicture
    • CVE-2023-2465: Inappropriate implementation in CORS
    • CVE-2023-2466: Inappropriate implementation in Prompts
    • CVE-2023-2467: Inappropriate implementation in Prompts
    • CVE-2023-2468: Inappropriate implementation in PictureInPicture
Record
openSUSE-SU-2023:0117-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12938-1 No score

chromedriver-113.0.5672.126-1.1 on GA media

These are all security issues fixed in the chromedriver-113.0.5672.126-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12938-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12962-1 No score

ungoogled-chromium-113.0.5672.126-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.126-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12962-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13009-1 No score

nodejs-electron-22.3.13-1.1 on GA media

These are all security issues fixed in the nodejs-electron-22.3.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13009-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 113.0.5672.126-1
113.0.5672.126-1
chromium
Debian:13
 before 113.0.5672.126-1
113.0.5672.126-1
chromium
Debian:14
 before 113.0.5672.126-1
113.0.5672.126-1
chromium
Debian:11
From an advisory covering 6 CVEs
 before 113.0.5672.126-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 45 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1
113.0.5672.126-1~deb11u1
opera
openSUSE:Leap 15.4 NonFree
From an advisory covering 43 CVEs
 before 99.0.4788.13-lp154.2.47.1
99.0.4788.13-lp154.2.47.1
opera
openSUSE:Leap 15.5 NonFree
From an advisory covering 89 CVEs
 before 99.0.4788.13-lp155.3.6.1
99.0.4788.13-lp155.3.6.1
chromium
SUSE:Package Hub 15 SP4
From an advisory covering 16 CVEs
 before 113.0.5672.126-bp154.2.87.1
113.0.5672.126-bp154.2.87.1
chromium
openSUSE:Leap 15.4
From an advisory covering 16 CVEs
 before 113.0.5672.126-bp154.2.87.1
113.0.5672.126-bp154.2.87.1
chromium
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 113.0.5672.126-1.1
113.0.5672.126-1.1
nodejs-electron
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 22.3.13-1.1
22.3.13-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2725 is a high vulnerability (CVSS 8.8) in Google Chrome, published May 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 24.7%, the 97th percentile. Fixed in chromium 113.0.5672.126-1.

References

Show 111 moreShow less
This page doesn't list everything

Left out here: 52 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open