Every CVE Search/ Get API key

CVE-2023-6706

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who...

8.8 HighFix available

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.65%Up 0.6 points since Dec 15, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-6706
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CVE List 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-6706
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2023-58927 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
EUVD-2023-58927
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jqrg-rvpw-5fw5 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who...

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
GHSA-jqrg-rvpw-5fw5
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2023-6706 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
ALPINE-CVE-2023-6706
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-6706
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2023-6706 8.8

Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
DEBIAN-CVE-2023-6706
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2023-0355 No score

New chromium-browser-stable 120.0.6099.129 fixes bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 120.0.6099.129 release, fixing bugs and 20 vulnerabilities, together with 120.0.6099.109, 120.0.6099.71 and 120.0.6099.62; some of them are listed below. High CVE-2023-6508: Use after free in Media Stream. Reported by Cassidy Kim(@cassidy6564) on 2023-10-31 High CVE-2023-6509: Use after free in Side Panel Search. Reported by Khalil Zhani on 2023-10-21 Medium CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car] on 2023-09-08 Low CVE-2023-6511: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-09-04 Low CVE-2023-6512: Inappropriate implementation in Web Browser UI. Reported by Om Apip on 2023-06-24 High CVE-2023-6702: Type Confusion in V8. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2023-11-10 High CVE-2023-6703: Use after free in Blink. Reported by Cassidy Kim(@cassidy6564) on 2023-11-14 High CVE-2023-6704: Use after free in libavif. Reported by Fudan University on 2023-11-23 High CVE-2023-6705: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-11-28 High CVE-2023-6706: Use after free in FedCM. Reported by anonymous on 2023-11-09 Medium CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel on 2023-11-21 High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19 Google is aware that an exploit for CVE-2023-7024 exists in the wild.

Record
MGASA-2023-0355
Updated
2026-11-02
OSVopenSUSE-SU-2024:0001-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0001-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0002-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0002-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0020-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Chromium 120.0.6099.216 (boo#1217839, boo#1218048, boo#1218302, boo#1218533, boo#1218719)

    • CVE-2024-0333: Insufficient data validation in Extensions
    • CVE-2024-0222: Use after free in ANGLE
    • CVE-2024-0223: Heap buffer overflow in ANGLE
    • CVE-2024-0224: Use after free in WebAudio
    • CVE-2024-0225: Use after free in WebGPU
    • CVE-2023-7024: Heap buffer overflow in WebRTC
    • CVE-2023-6702: Type Confusion in V8
    • CVE-2023-6703: Use after free in Blink
    • CVE-2023-6704: Use after free in libavif (boo#1218303)
    • CVE-2023-6705: Use after free in WebRTC
    • CVE-2023-6706: Use after free in FedCM
    • CVE-2023-6707: Use after free in CSS
    • CVE-2023-6508: Use after free in Media Stream
    • CVE-2023-6509: Use after free in Side Panel Search
    • CVE-2023-6510: Use after free in Media Capture
    • CVE-2023-6511: Inappropriate implementation in Autofill
    • CVE-2023-6512: Inappropriate implementation in Web Browser UI
Record
openSUSE-SU-2024:0020-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13583-1 No score

chromedriver-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the chromedriver-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13583-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13585-1 No score

ungoogled-chromium-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13585-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt6-qtwebengine
Alpine:v3.19
 before 6.6.1-r3
6.6.1-r3
qt6-qtwebengine
Alpine:v3.20
 before 6.6.1-r3
6.6.1-r3
qt6-qtwebengine
Alpine:v3.21
 before 6.6.1-r3
6.6.1-r3
qt6-qtwebengine
Alpine:v3.22
 before 6.6.1-r3
6.6.1-r3
qt6-qtwebengine
Alpine:v3.23
 before 6.6.1-r3
6.6.1-r3
qt6-qtwebengine
Alpine:v3.24
 before 6.6.1-r3
6.6.1-r3
chromium
Debian:12
 before 120.0.6099.109-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
120.0.6099.109-1~deb12u1
chromium
Debian:13
 before 120.0.6099.109-1
120.0.6099.109-1
chromium
Debian:14
 before 120.0.6099.109-1
120.0.6099.109-1
chromium
Debian:11
From an advisory covering 6 CVEs
 before 120.0.6099.109-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 45 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1
120.0.6099.109-1~deb11u1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
chromium
Debian:12
From an advisory covering 6 CVEs
 before 120.0.6099.109-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
120.0.6099.109-1~deb12u1
chromium-browser-stable
Mageia:9
From an advisory covering 12 CVEs
 before 120.0.6099.129-2.mga9.tainted
120.0.6099.129-2.mga9.tainted
opera
openSUSE:Leap 15.4 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp154.2.68.1
106.0.4998.19-lp154.2.68.1
opera
openSUSE:Leap 15.5 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp155.3.27.1
106.0.4998.19-lp155.3.27.1
chromium
SUSE:Package Hub 15 SP5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
chromium
openSUSE:Leap 15.5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
chromium
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 120.0.6099.216-1.1
120.0.6099.216-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6706 is a high vulnerability (CVSS 8.8) in Google Chrome, published December 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in qt6-qtwebengine 6.6.1-r3.

References

Show 34 moreShow less
This page doesn't list everything

Left out here: 162 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open