Every CVE Search/ Get API key

CVE-2023-7024

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker...

8.8 HighIn KEVPublic exploitFix available

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.67%Up 6.6 points since Dec 22, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-7024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-7024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2023-59215 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
EUVD-2023-59215
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-7c6v-f3h8-2x89 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker...

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
GHSA-7c6v-f3h8-2x89
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CISA KEV No score

Google Chromium WebRTC Heap Buffer Overflow Vulnerability

Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.

Record
CVE-2023-7024
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2023-7024 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
ALPINE-CVE-2023-7024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 10 moreShow less
OSV 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
CVE-2023-7024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-7024 8.8

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record
DEBIAN-CVE-2023-7024
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2023-0355 No score

New chromium-browser-stable 120.0.6099.129 fixes bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 120.0.6099.129 release, fixing bugs and 20 vulnerabilities, together with 120.0.6099.109, 120.0.6099.71 and 120.0.6099.62; some of them are listed below. High CVE-2023-6508: Use after free in Media Stream. Reported by Cassidy Kim(@cassidy6564) on 2023-10-31 High CVE-2023-6509: Use after free in Side Panel Search. Reported by Khalil Zhani on 2023-10-21 Medium CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car] on 2023-09-08 Low CVE-2023-6511: Inappropriate implementation in Autofill. Reported by Ahmed ElMasry on 2023-09-04 Low CVE-2023-6512: Inappropriate implementation in Web Browser UI. Reported by Om Apip on 2023-06-24 High CVE-2023-6702: Type Confusion in V8. Reported by Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group on 2023-11-10 High CVE-2023-6703: Use after free in Blink. Reported by Cassidy Kim(@cassidy6564) on 2023-11-14 High CVE-2023-6704: Use after free in libavif. Reported by Fudan University on 2023-11-23 High CVE-2023-6705: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-11-28 High CVE-2023-6706: Use after free in FedCM. Reported by anonymous on 2023-11-09 Medium CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel on 2023-11-21 High CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group on 2023-12-19 Google is aware that an exploit for CVE-2023-7024 exists in the wild.

Record
MGASA-2023-0355
Updated
2026-11-02
OSVopenSUSE-SU-2024:0001-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0001-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0002-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 106.0.4998.19

    • CHR-9416 Updating Chromium on desktop-stable-* branches
    • DNA-113887 Translations for O106

  • The update to chromium 120.0.6099.130 fixes following issues: CVE-2023-7024

  • Update to 106.0.4998.16

    • CHR-9553 Update Chromium on desktop-stable-120-4998 to 120.0.6099.109
    • DNA-112522 'Find in page' option does not show text cursor
    • DNA-113349 Lucid mode strength in full settings bar is visible only after change
    • DNA-113462 Crash at opera::fcm::FcmRegistrationServiceImpl:: RemoveTokenObserverForClient(opera::fcm::FcmClient*, syncer::FCMRegistrationTokenObserver*)
    • DNA-113748 Split preview shows on videoconferencing
    • DNA-114091 Promote 106 to stable

  • Complete Opera 106 changelog at: https://blogs.opera.com/desktop/changelog-for-106/

  • The update to chromium 120.0.6099.109 fixes following issues: CVE-2023-6702, CVE-2023-6703, CVE-2023-6704, CVE-2023-6705, CVE-2023-6706, CVE-2023-6707

  • Update to 105.0.4970.48

    • DNA-112522 'Find in page' option does not show text cursor
Record
openSUSE-SU-2024:0002-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0020-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Chromium 120.0.6099.216 (boo#1217839, boo#1218048, boo#1218302, boo#1218533, boo#1218719)

    • CVE-2024-0333: Insufficient data validation in Extensions
    • CVE-2024-0222: Use after free in ANGLE
    • CVE-2024-0223: Heap buffer overflow in ANGLE
    • CVE-2024-0224: Use after free in WebAudio
    • CVE-2024-0225: Use after free in WebGPU
    • CVE-2023-7024: Heap buffer overflow in WebRTC
    • CVE-2023-6702: Type Confusion in V8
    • CVE-2023-6703: Use after free in Blink
    • CVE-2023-6704: Use after free in libavif (boo#1218303)
    • CVE-2023-6705: Use after free in WebRTC
    • CVE-2023-6706: Use after free in FedCM
    • CVE-2023-6707: Use after free in CSS
    • CVE-2023-6508: Use after free in Media Stream
    • CVE-2023-6509: Use after free in Side Panel Search
    • CVE-2023-6510: Use after free in Media Capture
    • CVE-2023-6511: Inappropriate implementation in Autofill
    • CVE-2023-6512: Inappropriate implementation in Web Browser UI
Record
openSUSE-SU-2024:0020-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13532-1 No score

nodejs-electron-27.2.0-1.1 on GA media

These are all security issues fixed in the nodejs-electron-27.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13532-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13583-1 No score

chromedriver-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the chromedriver-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13583-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13585-1 No score

ungoogled-chromium-120.0.6099.216-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-120.0.6099.216-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13585-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14001-1 No score

libQt5Pdf5-5.15.17-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14001-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtwebengine
Alpine:v3.19
 before 5.15.16-r3
5.15.16-r3
qt5-qtwebengine
Alpine:v3.20
 before 5.15.16-r5
5.15.16-r5
qt5-qtwebengine
Alpine:v3.21
 before 5.15.16-r5
5.15.16-r5
qt5-qtwebengine
Alpine:v3.22
 before 5.15.16-r5
5.15.16-r5
qt5-qtwebengine
Alpine:v3.23
 before 5.15.16-r5
5.15.16-r5
qt6-qtwebengine
Alpine:v3.19
 before 6.6.1-r4
6.6.1-r4
qt6-qtwebengine
Alpine:v3.20
 before 6.6.1-r4
6.6.1-r4
qt6-qtwebengine
Alpine:v3.21
 before 6.6.1-r4
6.6.1-r4
qt6-qtwebengine
Alpine:v3.22
 before 6.6.1-r4
6.6.1-r4
qt6-qtwebengine
Alpine:v3.23
 before 6.6.1-r4
6.6.1-r4
Show 12 moreShow less
Affected packages
PackageAffectedFixed
qt6-qtwebengine
Alpine:v3.24
 before 6.6.1-r4
6.6.1-r4
chromium
Debian:12
 before 120.0.6099.129-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
120.0.6099.129-1~deb12u1
chromium
Debian:13
 before 120.0.6099.129-1
120.0.6099.129-1
chromium
Debian:14
 before 120.0.6099.129-1
120.0.6099.129-1
chromium
Debian:11
 before 120.0.6099.129-1~deb11u1, plus listed versions
100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1
Show 45 moreShow less
100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1
120.0.6099.129-1~deb11u1
chromium-browser-stable
Mageia:9
From an advisory covering 12 CVEs
 before 120.0.6099.129-2.mga9.tainted
120.0.6099.129-2.mga9.tainted
opera
openSUSE:Leap 15.4 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp154.2.68.1
106.0.4998.19-lp154.2.68.1
opera
openSUSE:Leap 15.5 NonFree
From an advisory covering 7 CVEs
 before 106.0.4998.19-lp155.3.27.1
106.0.4998.19-lp155.3.27.1
chromium
SUSE:Package Hub 15 SP5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
chromium
openSUSE:Leap 15.5
From an advisory covering 17 CVEs
 before 120.0.6099.216-bp155.2.64.1
120.0.6099.216-bp155.2.64.1
nodejs-electron
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 27.2.0-1.1
27.2.0-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 120.0.6099.216-1.1
120.0.6099.216-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubaka76bm/google-chrome-emergency-update2025-11-07

History

History
RecordedChangedSources
affected
exploitation
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-7024 is a high vulnerability (CVSS 8.8) in Google Chrome, published December 21, 2023. CISA lists it as known to be exploited, since January 2, 2024. EUVD reports exploitation since January 2, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.67%, the 93rd percentile. Fixed in qt5-qtwebengine 5.15.16-r3.

References

Show 49 moreShow less
This page doesn't list everything

Left out here: 148 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open