CVE-2023-5480

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a...

6.1 MediumFix available

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.14%Up 1.1 points since Nov 2, 2023

What each source reports

NVD Score used 6.1

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: CVE-2023-5480
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: CVE-2023-5480
Updated: 2026-11-02

EUVDEUVD-2023-57794 No score

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: EUVD-2023-57794
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c8pp-vxj4-7mp3 6.1

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a...

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: GHSA-c8pp-vxj4-7mp3
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: CVE-2023-5480
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-5480 6.1

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

Record: DEBIAN-CVE-2023-5480
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVMGASA-2023-0322 No score

Updated chromium-browser-stable packages fix bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 119.0.6045.159 release, fixing bugs and 15 vulnerabilities, together with 119.0.6045.123 and 119.0.6045.105; some of them are listed below:

High CVE-2023-5480: Inappropriate implementation in Payments. Reported by Vsevolod Kokorin (Slonser) of Solidlab on 2023-10-14

High CVE-2023-5482: Insufficient data validation in USB. Reported by DarkNavy on 2023-10-13

High CVE-2023-5849: Integer overflow in USB. Reported by DarkNavy on 2023-10-13

High CVE-2023-5996: Use after free in WebAudio. Reported by Huang Xilin of Ant Group Light-Year Security Lab via Tianfu Cup 2023 on 2023-10-30

High CVE-2023-5997: Use after free in Garbage Collection. Reported by Anonymous on 2023-10-31

High CVE-2023-6112: Use after free in Navigation. Reported by Sergei Glazunov of Google Project Zero on 2023-11-04

Medium CVE-2023-5850: Incorrect security UI in Downloads. Reported by Mohit Raj (shadow2639) on 2021-12-22

Medium CVE-2023-5851: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-08-18

Medium CVE-2023-5852: Use after free in Printing. Reported by [pwn2car] on 2023-09-10

Medium CVE-2023-5853: Incorrect security UI in Downloads. Reported by Hafiizh on 2023-06-22

Medium CVE-2023-5854: Use after free in Profiles. Reported by Dohyun Lee (@l33d0hyun) of SSD-Disclosure Labs & DNSLab, Korea Univ on 2023-10-01

Medium CVE-2023-5855: Use after free in Reading Mode. Reported by ChaobinZhang on 2023-10-13

Medium CVE-2023-5856: Use after free in Side Panel. Reported by Weipeng Jiang (@Krace) of VRI on 2023-10-17

Medium CVE-2023-5857: Inappropriate implementation in Downloads. Reported by Will Dormann on 2023-10-18

Low CVE-2023-5858: Inappropriate implementation in WebApp Provider. Reported by Axel Chong on 2023-06-24

Low CVE-2023-5859: Incorrect security UI in Picture In Picture. Reported by Junsung Lee on 2023-09-13

Record: MGASA-2023-0322
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0368-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium 119.0.6045.123 (boo#1216978)

CVE-2023-5996: Use after free in WebAudio

Chromium 119.0.6045.105 (boo#1216783)

CVE-2023-5480: Inappropriate implementation in Payments
CVE-2023-5482: Insufficient data validation in USB
CVE-2023-5849: Integer overflow in USB
CVE-2023-5850: Incorrect security UI in Downloads
CVE-2023-5851: Inappropriate implementation in Downloads
CVE-2023-5852: Use after free in Printing
CVE-2023-5853: Incorrect security UI in Downloads
CVE-2023-5854: Use after free in Profiles
CVE-2023-5855: Use after free in Reading Mode
CVE-2023-5856: Use after free in Side Panel
CVE-2023-5857: Inappropriate implementation in Downloads
CVE-2023-5858: Inappropriate implementation in WebApp Provider
CVE-2023-5859: Incorrect security UI in Picture In Picture

gn was updated to version 0.20231023:

many updates to support Chromium 119 build

Record: openSUSE-SU-2023:0368-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13419-1 No score

chromedriver-119.0.6045.123-1.1 on GA media

These are all security issues fixed in the chromedriver-119.0.6045.123-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13419-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13423-1 No score

ungoogled-chromium-119.0.6045.123-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-119.0.6045.123-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13423-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`chromium` Debian:12	before 119.0.6045.105-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	119.0.6045.105-1~deb12u1
`chromium` Debian:13	before 119.0.6045.105-1	119.0.6045.105-1
`chromium` Debian:14	before 119.0.6045.105-1	119.0.6045.105-1
`chromium` Debian:11 From an advisory covering 17 CVEs	before 119.0.6045.105-1~deb11u1, plus listed versions 100.0.4896.127-1100.0.4896.127-1~deb11u1100.0.4896.60-1100.0.4896.60-1~deb11u1100.0.4896.75-1 Show 45 moreShow less 100.0.4896.75-1~deb11u1100.0.4896.88-1100.0.4896.88-1~deb11u1101.0.4951.41-1101.0.4951.41-1~deb11u1101.0.4951.41-2101.0.4951.54-1101.0.4951.64-1101.0.4951.64-1~deb11u1102.0.5005.115-1102.0.5005.115-1~deb11u1102.0.5005.61-1102.0.5005.61-1~deb11u1103.0.5060.114-1103.0.5060.114-1~deb11u1103.0.5060.134-1103.0.5060.134-1~deb11u1103.0.5060.53-1103.0.5060.53-1~deb11u1104.0.5112.101-1104.0.5112.101-1~deb11u1104.0.5112.79-1104.0.5112.79-1~deb11u1105.0.5195.102-1105.0.5195.102-1~deb11u1105.0.5195.125-1105.0.5195.125-1~deb11u1105.0.5195.52-1105.0.5195.52-1~deb11u1106.0.5249.103-1106.0.5249.103-2106.0.5249.119-1106.0.5249.119-1~deb11u1106.0.5249.61-1106.0.5249.61-1~deb11u1106.0.5249.91-1106.0.5249.91-1~deb11u1107.0.5304.110-1107.0.5304.110-1~deb11u1107.0.5304.110-2107.0.5304.121-1107.0.5304.121-1~deb11u1107.0.5304.68-1107.0.5304.68-1~deb11u1107.0.5304.87-1	119.0.6045.105-1~deb11u1
`chromium` Debian:12 From an advisory covering 17 CVEs	before 119.0.6045.105-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	119.0.6045.105-1~deb12u1
`chromium-browser-stable` Mageia:9 From an advisory covering 16 CVEs	before 119.0.6045.159-1.mga9.tainted	119.0.6045.159-1.mga9.tainted
`chromium` SUSE:Package Hub 15 SP4 From an advisory covering 14 CVEs	before 119.0.6045.123-bp155.2.55.1	119.0.6045.123-bp155.2.55.1
`gn` SUSE:Package Hub 15 SP4 From an advisory covering 14 CVEs	before 0.20231023-bp155.5.3.1	0.20231023-bp155.5.3.1
`chromium` SUSE:Package Hub 15 SP5 From an advisory covering 14 CVEs	before 119.0.6045.123-bp155.2.55.1	119.0.6045.123-bp155.2.55.1
`gn` SUSE:Package Hub 15 SP5 From an advisory covering 14 CVEs	before 0.20231023-bp155.5.3.1	0.20231023-bp155.5.3.1

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`chromium` openSUSE:Leap 15.4 From an advisory covering 14 CVEs	before 119.0.6045.123-bp155.2.55.1	119.0.6045.123-bp155.2.55.1
`gn` openSUSE:Leap 15.4 From an advisory covering 14 CVEs	before 0.20231023-bp155.5.3.1	0.20231023-bp155.5.3.1
`chromium` openSUSE:Leap 15.5 From an advisory covering 14 CVEs	before 119.0.6045.123-bp155.2.55.1	119.0.6045.123-bp155.2.55.1
`gn` openSUSE:Leap 15.5 From an advisory covering 14 CVEs	before 0.20231023-bp155.5.3.1	0.20231023-bp155.5.3.1
`chromium` openSUSE:Tumbleweed From an advisory covering 14 CVEs	before 119.0.6045.123-1.1	119.0.6045.123-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-5480 is a medium vulnerability (CVSS 6.1) in Google Chrome, published November 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in chromium 119.0.6045.105-1~deb12u1.

References

Show 28 moreShow less

This page doesn't list everything

Left out here: 117 versions. The JSON record has them.