CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to...
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4762- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
CVE List
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4762- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
EUVDEUVD-2023-54609
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
EUVD-2023-54609- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3wjr-p76q-rg8q
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to...
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
GHSA-3wjr-p76q-rg8q- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
CISA KEV No score
Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2023-4762- Weakness
- CWE-843
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
ALPINE-CVE-2023-4762- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 7 moreShow less
OSV
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4762- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Record
DEBIAN-CVE-2023-4762- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0283 No score
Updated chromium-browser-stable package fixes bugs and vulnerabilities
The chromium-browser-stable package has been updated to the 117.0.5938.92 release, fixing bugs and 31 vulnerabilities, together with 117.0.5938.92, 117.0.5938.88, 117.0.5938.62, 116.0.5845.187 and 116.0.5845.179.
Google is aware that an exploit for CVE-2023-5217 exists in the wild.
High CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx. Reported by Clément Lecigne of Google's Threat Analysis Group on 2023-09-25
High CVE-2023-5186: Use after free in Passwords. Reported by [pwn2car] on 2023-09-05
High CVE-2023-5187: Use after free in Extensions. Reported by Thomas Orlita on 2023-08-25
Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06
Medium CVE-2023-4900: Inappropriate implementation in Custom Tabs. Reported by Levit Nudi from Kenya on 2023-04-06
Medium CVE-2023-4901: Inappropriate implementation in Prompts. Reported by Kang Ali on 2023-06-29
Medium CVE-2023-4902: Inappropriate implementation in Input. Reported by Axel Chong on 2023-06-14
Medium CVE-2023-4903: Inappropriate implementation in Custom Mobile Tabs. Reported by Ahmed ElMasry on 2023-05-18
Medium CVE-2023-4904: Insufficient policy enforcement in Downloads. Reported by Tudor Enache @tudorhacks on 2023-06-09
Medium CVE-2023-4905: Inappropriate implementation in Prompts. Reported by Hafiizh on 2023-04-29
Low CVE-2023-4906: Insufficient policy enforcement in Autofill. Reported by Ahmed ElMasry on 2023-05-30
Low CVE-2023-4907: Inappropriate implementation in Intents. Reported by Mohit Raj (shadow2639) on 2023-07-04
Low CVE-2023-4908: Inappropriate implementation in Picture in Picture. Reported by Axel Chong on 2023-06-06
Low CVE-2023-4909: Inappropriate implementation in Interstitials. Reported by Axel Chong on 2023-07-09
Critical CVE-2023-4863: Heap buffer overflow in WebP
High CVE-2023-4761: Out of bounds memory access in FedCM. Reported by DarkNavy on 2023-08-28
High CVE-2023-4762: Type Confusion in V8. Reported by anonymous on 2023-08-16
High CVE-2023-4763: Use after free in Networks. Reported by anonymous on 2023-08-03
High CVE-2023-4764: Incorrect security UI in BFCache. Reported by Irvan Kurniawan (sourc7) on 2023-05-20
- Record
MGASA-2023-0283- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0245-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 116.0.5845.179 (boo#1215023):
- CVE-2023-4761: Out of bounds memory access in FedCM
- CVE-2023-4762: Type Confusion in V8
- CVE-2023-4763: Use after free in Networks
- CVE-2023-4764: Incorrect security UI in BFCache
- Record
openSUSE-SU-2023:0245-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13204-1 No score
chromedriver-116.0.5845.179-1.1 on GA media
These are all security issues fixed in the chromedriver-116.0.5845.179-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13204-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13232-1 No score
ungoogled-chromium-116.0.5845.179-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-116.0.5845.179-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13232-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13462-1 No score
libQt5Pdf5-5.15.16-1.1 on GA media
These are all security issues fixed in the libQt5Pdf5-5.15.16-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13462-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt5-qtwebengineAlpine:v3.18 |
before 5.15.13-r8 | 5.15.13-r8 |
qt5-qtwebengineAlpine:v3.19 |
before 5.15.15-r2 | 5.15.15-r2 |
qt5-qtwebengineAlpine:v3.20 |
before 5.15.15-r2 | 5.15.15-r2 |
qt5-qtwebengineAlpine:v3.21 |
before 5.15.15-r2 | 5.15.15-r2 |
qt5-qtwebengineAlpine:v3.22 |
before 5.15.15-r2 | 5.15.15-r2 |
qt5-qtwebengineAlpine:v3.23 |
before 5.15.15-r2 | 5.15.15-r2 |
chromiumDebian:12 |
before 116.0.5845.180-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 30 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1~deb11u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2 |
116.0.5845.180-1~deb12u1 |
chromiumDebian:13 |
before 116.0.5845.180-1 | 116.0.5845.180-1 |
chromiumDebian:14 |
before 116.0.5845.180-1 | 116.0.5845.180-1 |
chromiumDebian:11 From an advisory covering 4 CVEs |
before 116.0.5845.180-1~deb11u1, plus listed versions 100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1 Show 45 moreShow less100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1 |
116.0.5845.180-1~deb11u1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 From an advisory covering 4 CVEs |
before 116.0.5845.180-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 30 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1~deb11u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2 |
116.0.5845.180-1~deb12u1 |
chromium-browser-stableMageia:9 From an advisory covering 18 CVEs |
before 117.0.5938.132-1.mga9.tainted | 117.0.5938.132-1.mga9.tainted |
chromiumSUSE:Package Hub 15 SP4 From an advisory covering 4 CVEs |
before 116.0.5845.179-bp155.2.28.1 | 116.0.5845.179-bp155.2.28.1 |
chromiumSUSE:Package Hub 15 SP5 From an advisory covering 4 CVEs |
before 116.0.5845.179-bp155.2.28.1 | 116.0.5845.179-bp155.2.28.1 |
chromiumopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 116.0.5845.179-bp155.2.28.1 | 116.0.5845.179-bp155.2.28.1 |
chromiumopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 116.0.5845.179-bp155.2.28.1 | 116.0.5845.179-bp155.2.28.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 116.0.5845.179-1.1 | 116.0.5845.179-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 116.0.5845.179-1.1 | 116.0.5845.179-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sherlocksecurity/CVE-2023-4762-Code-Review | 2023-09-27 |
| PoC in GitHub | zined/CVE-2023-4762 | 2023-09-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4762 is a high vulnerability (CVSS 8.8) in Google Chrome, published September 5, 2023. CISA lists it as known to be exploited, since February 6, 2024. EUVD reports exploitation since February 6, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 41.4%, the 98th percentile. Fixed in qt5-qtwebengine 5.15.13-r8.
References
chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html
crbug.com/1473247
debian.org/security/2023/dsa-5491
lists.fedoraproject.org/archives/list/[email protected]/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC
Show 40 moreShow less
security.gentoo.org/glsa/202311-11
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4762
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4762
nvd.nist.gov/vuln/detail/CVE-2023-4762
github.com/advisories/GHSA-3wjr-p76q-rg8q
security.alpinelinux.org/vuln/CVE-2023-4762
security-tracker.debian.org/tracker/CVE-2023-4762
advisories.mageia.org/MGASA-2023-0283.html
bugs.mageia.org/show_bug.cgi?id=32317
lists.opensuse.org/archives/list/[email protected]/thread/EK5CYLZ4C2MARJPZIDEMA6WV35L2EHUN
bugzilla.suse.com/1215023
suse.com/security/cve/CVE-2023-4761
Left out here: 87 versions. The JSON record has them.