CVE-2023-4860
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote...
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4860- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
CVE List
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4860- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
EUVDEUVD-2023-54700
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
EUVD-2023-54700- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxfq-8cc9-rwx9
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote...
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
GHSA-xxfq-8cc9-rwx9- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
OSV
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2023-4860- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-4860
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Record
DEBIAN-CVE-2023-4860- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2026:74084
Red Hat Security Advisory: webkit2gtk3 security update
- Record
RHSA-2026:74084- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:69098
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
-
chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
-
chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
-
chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
-
chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
-
chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
-
webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
-
webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
-
webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
-
webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
-
webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
-
chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
-
webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
-
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
-
webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
-
chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
-
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
-
webkitgtk: Processing maliciously crafted web…
- Record
RLSA-2026:69098- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:74084
Critical: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
-
chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
-
chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
-
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
-
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
-
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
-
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
-
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
-
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
-
chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)
-
chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)
-
chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)
-
chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)
-
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)
-
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
-
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)
-
chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)
-
chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)
-
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
-
chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)
-
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)
-
chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)
-
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)
-
chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)
-
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
-
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
-
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
-
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
-
chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)
-
chromium-browser: Use after free in ANGLE (CVE-2026-7359)
-
chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)
-
chromium-browser: Use after free in ANGLE (CVE-2026-7901)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
-
chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)
-
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
-
chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)
-
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
-
chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)
-
chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)
-
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
-
chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)
-
chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)
-
chromium-browser: chromium-browser: Inappropriate implementation in ANGLE…
- Record
RLSA-2026:74084- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:69098 No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
- chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
- chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
- chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
- chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
- webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
- webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
- webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
- webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
- webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
- chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
- webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
- webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
- webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
- chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635) *…
- Record
ALSA-2026:69098- Updated
- 2026-11-02
OSVALSA-2026:74084 No score
Critical: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
- chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)
- chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
- chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
- chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
- chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
- chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
- chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
- chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
- chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)
- chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)
- chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)
- chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)
- chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)
- chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
- chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
- chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)
- chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)
- chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)
- chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)
- chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
- chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)
- chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)
- chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)
- chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)
- chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)
- chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
- chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)
- chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
- chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
- chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
- chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)
- chromium-browser: Use after free in ANGLE (CVE-2026-7359)
- chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)
- chromium-browser: Use after free in ANGLE (CVE-2026-7901)
- chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
- chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)
- chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
- chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)
- chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
- chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)
- chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)
- chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
- chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)
- chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)
- chromium-browser:…
- Record
ALSA-2026:74084- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3AlmaLinux:9 |
before 2.54.0-1.el9_8 | 2.54.0-1.el9_8 |
webkit2gtk3-develAlmaLinux:9 |
before 2.54.0-1.el9_8 | 2.54.0-1.el9_8 |
webkit2gtk3-jscAlmaLinux:9 |
before 2.54.0-1.el9_8 | 2.54.0-1.el9_8 |
webkit2gtk3-jsc-develAlmaLinux:9 |
before 2.54.0-1.el9_8 | 2.54.0-1.el9_8 |
webkit2gtk3AlmaLinux:8 |
before 2.54.0-1.el8_10 | 2.54.0-1.el8_10 |
webkit2gtk3-develAlmaLinux:8 |
before 2.54.0-1.el8_10 | 2.54.0-1.el8_10 |
webkit2gtk3-jscAlmaLinux:8 |
before 2.54.0-1.el8_10 | 2.54.0-1.el8_10 |
webkit2gtk3-jsc-develAlmaLinux:8 |
before 2.54.0-1.el8_10 | 2.54.0-1.el8_10 |
chromiumDebian:12 |
before 115.0.5790.98-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 10 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.98-1~deb11u1 |
115.0.5790.98-1~deb12u1 |
chromiumDebian:13 |
before 115.0.5790.98-1 | 115.0.5790.98-1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:14 |
before 115.0.5790.98-1 | 115.0.5790.98-1 |
chromiumDebian:11 |
before 115.0.5790.98-1~deb11u1, plus listed versions 100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1 Show 45 moreShow less100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1 |
115.0.5790.98-1~deb11u1 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
webkit2gtk3Rocky Linux:9 |
before 0:2.54.0-1.el9_8 | 0:2.54.0-1.el9_8 |
webkit2gtk3Rocky Linux:8 |
before 0:2.54.0-1.el8_10 | 0:2.54.0-1.el8_10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4860 is a critical vulnerability (CVSS 9.6) in Google Chrome, published July 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in webkit2gtk3 2.54.0-1.el9_8.
References
chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html
issues.chromium.org/issues/40064341
nvd.nist.gov/vuln/detail/CVE-2023-4860
github.com/advisories/GHSA-xxfq-8cc9-rwx9
access.redhat.com/errata/RHSA-2026:69098
Show 194 moreShow less
bugzilla.redhat.com/2388151
errata.almalinux.org/9/ALSA-2026-69098.html
redhat.com/security/data/cve/CVE-2023-4860.html
security-tracker.debian.org/tracker/CVE-2023-4860
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74084.json
cve.org/CVERecord?id=CVE-2023-4860
cisa.gov/known-exploited-vulnerabilities-catalog
webkitgtk.org/security/WSA-2026-0005.html
bugs.webkit.org/show_bug.cgi?id=313528
support.apple.com/en-us/148281
errata.rockylinux.org/RLSA-2026:69098
Left out here: 67 versions, 1,855 references and the rest of 4 source descriptions. The JSON record has them.