Every CVE Search/ Get API key

CVE-2023-6704

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to...

8.8 HighFix available

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.66%Up 0.6 points since Dec 15, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
CVE-2023-6704
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
CVE-2023-6704
Updated
2026-11-02
EUVDEUVD-2023-58925 No score

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
EUVD-2023-58925
Updated
2026-11-03
GitHub AdvisoriesGHSA-587x-fmc5-99p9 8.8

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to...

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
GHSA-587x-fmc5-99p9
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 8.8

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
CVE-2023-6704
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-6704 8.8

Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)

Record
DEBIAN-CVE-2023-6704
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVMGASA-2023-0355 No score

New chromium-browser-stable 120.0.6099.129 fixes bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 120.0.6099.129 release, fixing bugs and 20 vulnerabilities, together with 120.0.6099.109, 120.0.6099.71 and 120.0.6099.62; some of them are listed below. High CVE-2023-6508: Use after free in Media Stream. Reported by Cassidy Kim(@cassidy6564) on 2023-10-31 High CVE-2023-6509: Use after free in Side Panel Search. Reported by Khalil Zhani on 2023-10-21 Medium CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car] on 2023-09-08 Low CVE-2023-6511: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-09-04 Low CVE-2023-6512: Inappropriate implementation in Web Browser UI. Reported by Om Apip on 2023-06-24 High CVE-2023-6702: Type Confusion in V8. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2023-11-10 High CVE-2023-6703: Use after free in Blink. Reported by Cassidy Kim(@cassidy6564) on 2023-11-14 High CVE-2023-6704: Use after free in libavif. Reported by Fudan University on 2023-11-23 High CVE-2023-6705: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-11-28 High CVE-2023-6706: Use after free in FedCM. Reported by anonymous on 2023-11-09 Medium CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel on 2023-11-21 High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19 Google is aware that an exploit for CVE-2023-7024 exists in the wild.

Record
MGASA-2023-0355
Updated
2026-11-02
OSVopenSUSE-SU-2024:0001-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0001-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0002-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0002-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0020-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Chromium 120.0.6099.216 (boo#1217839, boo#1218048, boo#1218302, boo#1218533, boo#1218719)

    • CVE-2024-0333: Insufficient data validation in Extensions
    • CVE-2024-0222: Use after free in ANGLE
    • CVE-2024-0223: Heap buffer overflow in ANGLE
    • CVE-2024-0224: Use after free in WebAudio
    • CVE-2024-0225: Use after free in WebGPU
    • CVE-2023-7024: Heap buffer overflow in WebRTC
    • CVE-2023-6702: Type Confusion in V8
    • CVE-2023-6703: Use after free in Blink
    • CVE-2023-6704: Use after free in libavif (boo#1218303)
    • CVE-2023-6705: Use after free in WebRTC
    • CVE-2023-6706: Use after free in FedCM
    • CVE-2023-6707: Use after free in CSS
    • CVE-2023-6508: Use after free in Media Stream
    • CVE-2023-6509: Use after free in Side Panel Search
    • CVE-2023-6510: Use after free in Media Capture
    • CVE-2023-6511: Inappropriate implementation in Autofill
    • CVE-2023-6512: Inappropriate implementation in Web Browser UI
Record
openSUSE-SU-2024:0020-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13534-1 No score

avif-tools-1.0.3-1.1 on GA media

These are all security issues fixed in the avif-tools-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13534-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13560-1 No score

nodejs-electron-27.2.1-1.1 on GA media

These are all security issues fixed in the nodejs-electron-27.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13560-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13583-1 No score

chromedriver-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the chromedriver-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13583-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13585-1 No score

ungoogled-chromium-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13585-1
Updated
2026-11-02
OSVSUSE-SU-2024:0423-1 No score

Security update for libavif

This update for libavif fixes the following issues:

  • CVE-2023-6704: Fixed use after free by not storing colorproperties until alpha item is found (bsc#1218303).
Record
SUSE-SU-2024:0423-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 120.0.6099.109-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
120.0.6099.109-1~deb12u1
chromium
Debian:13
 before 120.0.6099.109-1
120.0.6099.109-1
chromium
Debian:14
 before 120.0.6099.109-1
120.0.6099.109-1
libavif
Debian:13
 before 1.1.0-1
1.1.0-1
libavif
Debian:14
 before 1.1.0-1
1.1.0-1
chromium
Debian:11
From an advisory covering 6 CVEs
 before 120.0.6099.109-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 45 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1
120.0.6099.109-1~deb11u1
chromium
Debian:12
From an advisory covering 6 CVEs
 before 120.0.6099.109-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
120.0.6099.109-1~deb12u1
chromium-browser-stable
Mageia:9
From an advisory covering 12 CVEs
 before 120.0.6099.129-2.mga9.tainted
120.0.6099.129-2.mga9.tainted
libavif
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
libavif
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
SUSE:Manager Proxy 4.3
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
SUSE:Manager Server 4.3
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
libavif
openSUSE:Leap 15.5
 before 0.9.3-150400.3.3.1
0.9.3-150400.3.3.1
opera
openSUSE:Leap 15.4 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp154.2.68.1
106.0.4998.19-lp154.2.68.1
opera
openSUSE:Leap 15.5 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp155.3.27.1
106.0.4998.19-lp155.3.27.1
chromium
SUSE:Package Hub 15 SP5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
chromium
openSUSE:Leap 15.5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
libavif
openSUSE:Tumbleweed
 before 1.0.3-1.1
1.0.3-1.1
nodejs-electron
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 27.2.1-1.1
27.2.1-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 120.0.6099.216-1.1
120.0.6099.216-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6704 is a high vulnerability (CVSS 8.8) in Google Chrome, published December 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in chromium 120.0.6099.109-1~deb12u1.

References

Show 34 moreShow less
This page doesn't list everything

Left out here: 162 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open